9f4132eb0a2789efa525bad82985eecd66df89b80cfe157111115d6a875ceea0

Analysis

max time kernel
12s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
Size 2.9MB
Sample260519-1d2rtac16t
SHA256 9f4132eb0a2789efa525bad82985eecd66df89b80cfe157111115d6a875ceea0
MD5 5d2c0aa1dc4a754ea95eec11a34df042
SHA1 8d94b5bd9808ac9273ab46196050e587db9f8a9c
SHA512 157835bbfeb6accd731b594bedc55fbec7cab13c16f5e840a643d5cf8ff44da291f1d0ab732484ecd934297debc55425d5e273481af6acd8f710da0d90263f10
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1i:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBi4
TLSH
T129D52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
1272	spfirewall.exe
1572	272.#.exe
3968	399.#.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	spfirewall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	spfirewall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	272.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	272.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	399.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	399.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\systemlog.log	spfirewall.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spfirewall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	399.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode\ = "{0CF774D1-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asa	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.html	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder\ = "Script Encoder Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.html	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode\ = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode\ = "{85131631-480C-11D2-B1F9-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode\ = "{0CF774D1-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TypeLib	regsvr32.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	272.#.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1804	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
1272	spfirewall.exe
1572	272.#.exe
3968	399.#.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3840	1804	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe	87
PID 1272 wrote to memory of 2336	1272	spfirewall.exe	93
PID 1804 wrote to memory of 4052	1804	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe	94
PID 1272 wrote to memory of 828	1272	spfirewall.exe	95
PID 1804 wrote to memory of 1572	1804	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe	96
PID 1572 wrote to memory of 3308	1572	272.#.exe	97
PID 1272 wrote to memory of 3968	1272	spfirewall.exe	98
PID 3968 wrote to memory of 4828	3968	399.#.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3840
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\175884.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\272.#.exe
  C:\Users\Admin\AppData\Local\Temp\272.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3308
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\402157.vbs"
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\895.#.exe
    C:\Users\Admin\AppData\Local\Temp\895.#.exe
    3⤵
    PID:668
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      PID:3992
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\863094.vbs"
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\550.#.exe
      C:\Users\Admin\AppData\Local\Temp\550.#.exe
      4⤵
      PID:3060
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        
        PID:4024
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\680233.vbs"
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\837.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\837.#.exe
        5⤵
        
        PID:2424
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:2152
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\179302.vbs"
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\960.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\960.#.exe
        6⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\442730.vbs"
        7⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\515.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\515.#.exe
        7⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\734630.vbs"
        8⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\861.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\861.#.exe
        8⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\604015.vbs"
        9⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\972.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\972.#.exe
        9⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\710659.vbs"
        10⤵
        
        PID:4900

C:\Windows\system32\regsvr32.exe
regsvr32.exe /s scrrun.dll
1⤵
- Modifies registry class
PID:1808

C:\10a0699fa37928d39c\spfirewall.exe
C:\10a0699fa37928d39c\spfirewall.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2336
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\374080.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:828
- C:\10a0699fa37928d39c\399.#.exe
  C:\10a0699fa37928d39c\399.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4828
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\299617.vbs"
    3⤵
    PID:2172
- - C:\10a0699fa37928d39c\306.#.exe
    C:\10a0699fa37928d39c\306.#.exe
    3⤵
    PID:4352
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      PID:4604
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\400982.vbs"
      4⤵
      PID:4168
  - - C:\10a0699fa37928d39c\654.#.exe
      C:\10a0699fa37928d39c\654.#.exe
      4⤵
      PID:1856
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        
        PID:1896
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\83599.vbs"
        5⤵
        
        PID:732
    - - C:\10a0699fa37928d39c\13.#.exe
        
        C:\10a0699fa37928d39c\13.#.exe
        5⤵
        
        PID:2728
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:4060
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\376079.vbs"
        6⤵
        
        PID:1556
      - C:\10a0699fa37928d39c\467.#.exe
        
        C:\10a0699fa37928d39c\467.#.exe
        6⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\681942.vbs"
        7⤵
        
        PID:4924
        
        C:\10a0699fa37928d39c\775.#.exe
        
        C:\10a0699fa37928d39c\775.#.exe
        7⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\243862.vbs"
        8⤵
        
        PID:748
        
        C:\10a0699fa37928d39c\508.#.exe
        
        C:\10a0699fa37928d39c\508.#.exe
        8⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        
        PID:972
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\969448.vbs"
        9⤵
        
        PID:4600
        
        C:\10a0699fa37928d39c\501.#.exe
        
        C:\10a0699fa37928d39c\501.#.exe
        9⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        
        PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spfirewall.exe

Path C:\10a0699fa37928d39c\spfirewall.exe
Size 2.9MB
SHA256 9f4132eb0a2789efa525bad82985eecd66df89b80cfe157111115d6a875ceea0
MD5 5d2c0aa1dc4a754ea95eec11a34df042
SHA1 8d94b5bd9808ac9273ab46196050e587db9f8a9c
SHA512 157835bbfeb6accd731b594bedc55fbec7cab13c16f5e840a643d5cf8ff44da291f1d0ab732484ecd934297debc55425d5e273481af6acd8f710da0d90263f10
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1i:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBi4
TLSH
T129D52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe$

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe$
Size 2.9MB
SHA256 ef3bf399f05747e44bd62735a02458c3f974e6df94822396f5b494b3bc609dc3
MD5 aec0ffe80a4f1992b60ff094ba0b661e
SHA1 ebbd6f0c43d5ee7f2d7764d4c93e0d5678f5ce81
SHA512 75722e0eb7a0f6dd7b349c1fd15738a2f2f87743b131c6adbed2ef59e32d61be8de0a0aae0fe44cb32170633e48a2bfcd3e4d695db98f9dbd01b12c1ad81a001
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1k:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBim
TLSH
T103E52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe$
Size 2.9MB
SHA256 568edba4a3a29695f23e38c7ce23d5b8301194eb9a08a7d20525a7332972a749
MD5 eaf43033e35478bfc431950230aad213
SHA1 ddc1fd83fbe46cac04fd773608e89146a73133ce
SHA512 3c33bbc0d9c92a591baa7e09e6797244de4b8176b833737f17cdfe4012a5aa5fb9e7a2a333e89ae42d50fc1ecc02c8b5f442e0134b881bcf4b59c47dc66250cc
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1H:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBiZ
TLSH
T1F7E52901AB635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C266323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$
Size 2.9MB
SHA256 aae1d00ec6668c675eb61706c9c313c039e24f37dc699658833e29c86ff674c1
MD5 e87d88e49e332d7d1acc3cb52b9e1196
SHA1 00363ec7482fe6c2628e67785fcd38f4e2e72568
SHA512 ee0b285b44cd911ea6a9fe09c561f55498a1ada71dd3c61d0ac05b9357ccc946721de8356f12e3c1e776ae02a12f461b9b7dda723108cb3a188a4019e668e1ca
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1z:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBi1
TLSH
T1E8E52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$
Size 2.9MB
SHA256 d320abd17599099bb68940ff4d27a7f4d688a95b2f1addffff1cda3416c32391
MD5 abbb88a787b3c19f092625318917b1c9
SHA1 991cc35879b2039356e25610ed7083de858015f8
SHA512 dfcb3ee08138c0102e348396069fb0b51583f37bd9cd21e44d0f2de9876eef0c4e55ad0003c4fc273f94e158b71d42114f7b68c9a03ab5886d33f49795705995
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1e:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBiQ
TLSH
T12FE52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

175884.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\175884.vbs
Size 1KB
SHA256 51cdf0fa0ab0766ce9ac2d8390b86860625266d651eafd71772063f349724f32
MD5 4c0328917a4d6aa4c8e58ee60773cb6f
SHA1 5bd7de9d039dcc2fb6ef7335f7f188f22f0d8365
SHA512 6e8d32690e3a1a3bc381f86b91143567bf6bfae8864f01a21488b5c64775063af8953d5a91d089f99f9f51dc190dde4da81ecd84b114c77e3a85706b4af106df
TLSH
T159215335DC2E817A4317A1E64AE740CCEB9AE84920B5F41C4645F98D62F45704B1B1EA
MD5 SHA1 SHA512 TLSH

Submit Download

175884.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\175884.vbs
Size 1KB
SHA256 f7746107df80e83f43c0c1debfeae4f580881c6f2917e676a337694f55897ed8
MD5 7adacceb6faa0c256181ab24d6340fde
SHA1 e2869b64be3a69c3e066ac7bffde420599e79e63
SHA512 c2fdad16e23b0a7719d9761738959538744d0f89af8799d1ea300f9292f5f022fd1b8bdf4484daa2cb3935f3b9615cda8d6e612d6b7d0f1f5fb62c0aa11d15b2
TLSH
T169314339EC2E817A4317A1E64BF740CCFB9AEC4920B6F41C4645F98DA2F45704B1B1EA
MD5 SHA1 SHA512 TLSH

Submit Download

175884.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\175884.vbs
Size 8KB
SHA256 0639e581e8d444631de769a890828a2422d0d4a2242b5c08250d2f9c037cd14a
MD5 a8d6254341a9471d98d89034122c78e2
SHA1 820b608a1971f422d01c7150f11758e33b6edf5f
SHA512 6384b187d4b0497d1d546caec1f44d37583bc68f471f1f588720f52b5a77b66964d2af89f49c3b7e5c1d683a253bc75a2b07c41791c5a1d545d37d2c310d6b82
SSDEEP 192:InKAhFw4rJWAm+CQBD4kTj4CPYb1k9RiO7TKVBlMcfWJVFsPXnMqqDvGs1OPqYcY:TyRm
TLSH
T1EE024439EC2EC5768307A2F60BE744DCE74EEC5924A5F01C0612F98DA2F16714B1A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

175884.vbs

Path C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\175884.vbs
Size 19KB
SHA256 68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a
MD5 e98740f59246b23b0d7f73f141f24d47
SHA1 1bfd55b3f13c85f94e1694bffa89a2d79a61a630
SHA512 d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928
SSDEEP 192:InKAhFw4rJWAm+CQBD4kTj4CPYb1k9RiO7TKVBlMcfWJVFsPXnMqqDvGs1OPqYc4:TyRi2mpCC
TLSH
T17E925435EC2E817A8317A2E60BF740DCFB8EEC5924A5F01C0652F98DA2F1671471A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1804-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads