Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/06/2026, 04:20
Behavioral task
behavioral1
Sample
1c0209189afed95d24febf040caa52b1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c0209189afed95d24febf040caa52b1.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target 1c0209189afed95d24febf040caa52b1.exe
- Size 2.5MB
- Sample260620-eyjk3set6y
- SHA256 1603899e2cbe71abad453b7c2735a294b93e23e4bedcb9e9f8e74b08b2564efb
- MD5 1c0209189afed95d24febf040caa52b1
- SHA1 232572ab53a2cdaf7fb6c68e3f80e356e88d290a
- SHA512 5ddf6d31201c536ccbb9b35e492317b9fa78be0c12287cb176247f3a933ed5eb9c3d65dd2bbf8e9c76c224dbdb8b5a1b0c2add85391b666bd01d08b0e82e718a
- SSDEEP 49152:V+MRvHbvO7diKmhA30jh67MZ2Z9ftchfudg87dqn7iMP:VrjWEjh+MYchXqdnMP
- TLSH T147C5E013B3CBE13EE05E0B370572A1E495FB6662A523AD1697EC84ACCF250601E3E757
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.243.155.184:770
-
47.243.155.184:771
-
127.0.0.1:80
Attributes
-
campaign_date
2026. 6. 2
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 4 IoCs
pid Process 2776 1c0209189afed95d24febf040caa52b1.tmp 3388 LockAppHost.exe 5292 LockAppHost.exe 2676 LockAppHost.exe - Loads dropped DLL 3 IoCs
pid Process 3388 LockAppHost.exe 5292 LockAppHost.exe 2676 LockAppHost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsLockHost = "C:\\Users\\Admin\\AppData\\Local\\guo6sa2ris\\LockAppHost.exe" LockAppHost.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: LockAppHost.exe File opened (read-only) \??\S: LockAppHost.exe File opened (read-only) \??\M: LockAppHost.exe File opened (read-only) \??\U: LockAppHost.exe File opened (read-only) \??\W: LockAppHost.exe File opened (read-only) \??\H: LockAppHost.exe File opened (read-only) \??\N: LockAppHost.exe File opened (read-only) \??\K: LockAppHost.exe File opened (read-only) \??\Z: LockAppHost.exe File opened (read-only) \??\L: LockAppHost.exe File opened (read-only) \??\G: LockAppHost.exe File opened (read-only) \??\G: LockAppHost.exe File opened (read-only) \??\O: LockAppHost.exe File opened (read-only) \??\G: LockAppHost.exe File opened (read-only) \??\V: LockAppHost.exe File opened (read-only) \??\P: LockAppHost.exe File opened (read-only) \??\K: LockAppHost.exe File opened (read-only) \??\S: LockAppHost.exe File opened (read-only) \??\W: LockAppHost.exe File opened (read-only) \??\M: LockAppHost.exe File opened (read-only) \??\R: LockAppHost.exe File opened (read-only) \??\Y: LockAppHost.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\R: LockAppHost.exe File opened (read-only) \??\I: LockAppHost.exe File opened (read-only) \??\X: LockAppHost.exe File opened (read-only) \??\U: LockAppHost.exe File opened (read-only) \??\Y: LockAppHost.exe File opened (read-only) \??\D: LockAppHost.exe File opened (read-only) \??\N: LockAppHost.exe File opened (read-only) \??\T: LockAppHost.exe File opened (read-only) \??\I: LockAppHost.exe File opened (read-only) \??\U: LockAppHost.exe File opened (read-only) \??\X: LockAppHost.exe File opened (read-only) \??\Q: LockAppHost.exe File opened (read-only) \??\V: LockAppHost.exe File opened (read-only) \??\B: LockAppHost.exe File opened (read-only) \??\L: LockAppHost.exe File opened (read-only) \??\N: LockAppHost.exe File opened (read-only) \??\W: LockAppHost.exe File opened (read-only) \??\J: LockAppHost.exe File opened (read-only) \??\R: LockAppHost.exe File opened (read-only) \??\D: LockAppHost.exe File opened (read-only) \??\J: LockAppHost.exe File opened (read-only) \??\M: LockAppHost.exe File opened (read-only) \??\Q: LockAppHost.exe File opened (read-only) \??\J: LockAppHost.exe File opened (read-only) \??\S: LockAppHost.exe File opened (read-only) \??\X: LockAppHost.exe File opened (read-only) \??\H: LockAppHost.exe File opened (read-only) \??\B: LockAppHost.exe File opened (read-only) \??\Z: LockAppHost.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\Q: LockAppHost.exe File opened (read-only) \??\P: LockAppHost.exe File opened (read-only) \??\O: LockAppHost.exe File opened (read-only) \??\V: LockAppHost.exe File opened (read-only) \??\H: LockAppHost.exe File opened (read-only) \??\I: LockAppHost.exe File opened (read-only) \??\T: LockAppHost.exe File opened (read-only) \??\Z: LockAppHost.exe File opened (read-only) \??\Y: LockAppHost.exe File opened (read-only) \??\D: LockAppHost.exe File opened (read-only) \??\O: LockAppHost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LockAppHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c0209189afed95d24febf040caa52b1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c0209189afed95d24febf040caa52b1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LockAppHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LockAppHost.exe - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/5424-0-0x0000000001000000-0x00000000010D8000-memory.dmp innosetup behavioral2/memory/5424-41-0x0000000001000000-0x00000000010D8000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 39 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{6A9F9ADD-9932-47EE-9E13-EB8FF66EDDEE} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{7EA1808A-F28C-416D-AE62-ADDEDD2E0578} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings 1c0209189afed95d24febf040caa52b1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache SearchHost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6020 schtasks.exe 5196 schtasks.exe 236 schtasks.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4536 WINWORD.EXE 4536 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5292 LockAppHost.exe 5292 LockAppHost.exe 5292 LockAppHost.exe 5292 LockAppHost.exe 5292 LockAppHost.exe 5292 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 3388 LockAppHost.exe 3388 LockAppHost.exe 3388 LockAppHost.exe 3388 LockAppHost.exe 3388 LockAppHost.exe 3388 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe 2676 LockAppHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe Token: SeShutdownPrivilege 2904 explorer.exe Token: SeCreatePagefilePrivilege 2904 explorer.exe - Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 2776 1c0209189afed95d24febf040caa52b1.tmp 4536 WINWORD.EXE 4536 WINWORD.EXE 2044 sihost.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe 2904 explorer.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4536 WINWORD.EXE 4536 WINWORD.EXE 4536 WINWORD.EXE 4536 WINWORD.EXE 4536 WINWORD.EXE 4536 WINWORD.EXE 4536 WINWORD.EXE 4536 WINWORD.EXE 5292 LockAppHost.exe 3388 LockAppHost.exe 2676 LockAppHost.exe 2820 StartMenuExperienceHost.exe 2540 SearchHost.exe 2904 explorer.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5424 wrote to memory of 2776 5424 1c0209189afed95d24febf040caa52b1.exe 88 PID 2776 wrote to memory of 3388 2776 1c0209189afed95d24febf040caa52b1.tmp 89 PID 3388 wrote to memory of 6020 3388 LockAppHost.exe 90 PID 5292 wrote to memory of 5196 5292 LockAppHost.exe 94 PID 2776 wrote to memory of 4536 2776 1c0209189afed95d24febf040caa52b1.tmp 96 PID 2676 wrote to memory of 236 2676 LockAppHost.exe 100 PID 2044 wrote to memory of 2904 2044 sihost.exe 107 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c0209189afed95d24febf040caa52b1.exe"C:\Users\Admin\AppData\Local\Temp\1c0209189afed95d24febf040caa52b1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\is-T5AGJ.tmp\1c0209189afed95d24febf040caa52b1.tmp"C:\Users\Admin\AppData\Local\Temp\is-T5AGJ.tmp\1c0209189afed95d24febf040caa52b1.tmp" /SL5="$40218,1652482,826880,C:\Users\Admin\AppData\Local\Temp\1c0209189afed95d24febf040caa52b1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe"C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /tn "WindowsLockHost" /tr "\"C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe\"" /sc onlogon /rl highest4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:6020
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\guo6sa2ris\France Relaxed Itinerary Overview.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4536
-
-
-
C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exeC:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /tn "WindowsLockHost" /tr "\"C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe\"" /sc onlogon /rl highest2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5196
-
-
C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe"C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /tn "WindowsLockHost" /tr "\"C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe\"" /sc onlogon /rl highest2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:236
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2540
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2820
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD77F2.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-T5AGJ.tmp\1c0209189afed95d24febf040caa52b1.tmp
- Size 3.3MB
- SHA256 81cbdf0b346c93b49887aec09df28c1732bbf3ecf24059833daa92f923a15270
- MD5 8f05a79e4d1a069d9a135541153e9ae3
- SHA1 ada36f629ca185b68a2f1463350da4677f8422fe
- SHA512 3a65017b4183b2f58f5c09326bf57e7bbd3261b01a0f9711613a7ca00ebb302a9e6636def82dff3605f315a8b1b2cb3c6e4ca3e0149c803a7c404bb739962e59
- SSDEEP 49152:QuAKxvISKItheRQSJ3MhjxImhEzAW308A3oWtKFz0ool5+UKLi333fx:QuAK64MmhKAWHooWJb333J
- TLSH T10CF56D23F34D603EF06A1A39DD279698583F76606516CC5797FC3A8C8F361802E2A75B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\guo6sa2ris\France Relaxed Itinerary Overview.docx
- Size 711KB
- SHA256 dfe31e1eb74ccb5959ff40f3c28b430041c81da6418c6dacaecc6a7101466a3c
- MD5 b9ee1015a4fbd91b13aae7970cff290f
- SHA1 2eb1c83debc9b6a107b6373240f0e9323fc2c213
- SHA512 9593109dd560282c5b070605561d4d4910a8c12a4aec3ad9a9a9795850255e750b05ddc8a135bd33b9be301efd31c73273679e91c49ce63a86dfd38dc53d2a53
- SSDEEP 12288:JzlNoayHQ6yM1pTaXI/fT75wgEk5Iu3M28jg8GxlDP/lofIUjj6aY3Kg00vbpdp8:JBCayHQMTaXo7iHkeO0jg399ofJj7gKJ
- TLSH T1B8F42345EB00E0E6F63352B021E9530DD33BFD16BB2A571B858986DCDC6A4B60F666C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\guo6sa2ris\LockAppHost.exe
- Size 74KB
- SHA256 65e0de657a7bd32aaf53239edecc608b1bf08ea0a6cfed58894993c437b83b15
- MD5 425a5c140eb53e863b77513cf1b981fe
- SHA1 944ecb6819c0060cb31a225c5663d954a48ddb69
- SHA512 9e36e7b9ef3af51622ad3902824689330e877199ba7783f2a2b1fe9c48e56528b136568c8212c2838cb43de3614e70ec0a77f436cc86c881cb02a1d5ac06823a
- SSDEEP 1536:o+4RQ8COb5ZhrGPSd1EOzag9M2KAGXU9FGtqx53zxx0132sP+dkzQn3:o+F8CuFtUazngU9F6qx53zn01GsLW3
- TLSH T15A736C63BB406471C6A238700A5AFA355BBEA3B04F2046D3175496F91DB23C35E3766F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\guo6sa2ris\LockHostingFramework.dll
- Size 235KB
- SHA256 fae029e2f7b17ff9cdf0baf953b1d03d1a7e636f236533d70c7ae1b23837f20e
- MD5 4e263c779a81c0c0c8f443f17812f3de
- SHA1 bd8910cfe09ea0f78211a9961bcb787dadd34e3d
- SHA512 dbbbdb279186b11a85e2fd02837b4ae7b4c865702873b96253f9cdd03854b65348d6ab9429a94440a8d27c81cc048979607fff6aeecbfcb1948c3ee776f562f6
- SSDEEP 6144:b4Vu66ihBa4crNMuQeQzFgj7W/JnsrUtZPE:8TBajWuQeQzFgj0p
- TLSH T11634199CFB4704F0F23356B5891EE7F7862475058132ABBBFF4FC685B4B26422A51289
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\guo6sa2ris\msiexec.dll
- Size 4KB
- SHA256 8eca63d50f5e0a39d5015b86a7c2c86b4140cde495c680685387fda84f958432
- MD5 8589cdb58ae8fa7625e362c2c4f1804d
- SHA1 45d6e3adcab9736ed106ee7e1e4a1d2b60fe1693
- SHA512 0535be6d7d7549056e659102f0f95da3a9e9355072146e27a9a70d54bfd7c1e6777ebf069348d9be19ba8cb7eb59bca344557c2a040e59e93bb3b0f125953f76
- SSDEEP 96:YLgWgx6VzAENmAsbgiMVavEL6+VOxr2sjpZo+iO9Nftj:Y0WgOszAsbgi5p8+iOHfp
- TLSH T18991521562413A7936DFCB02A511622AC9186E107B42300D9FF282EF3F5FBF24B350D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\guo6sa2ris\wbem.dll
- Size 4KB
- SHA256 ed72873639c4d756b3da17e9e6d2f7c9e9c27daca6d0e474ccdc3242b5958430
- MD5 31cdd9b41558f319154033d11adcf26a
- SHA1 ed0addd48b91a8aa928bb861d06c75f9cd0836b4
- SHA512 10ec3872cc599cfcffcbb3e2d812123bb17f3377a7cf63afc715a93d213992835ac7453b766be9a5ae9979aadad1af85237a615c9ec5c36207bb6e9f640364be
- SSDEEP 96:YLgWgx6VzAENmAsbgiMVavEL6+VOxr2sjpZo+iO9vqj:Y0WgOszAsbgi5p8+iOA
- TLSH T10F91422561417A7936DFCB56A911662AC9286E107A41300A9FF281EF3F5FBF24B340D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512