05dd55e06c94d36a0b387a36f212dd45f46e78b8394038949fedb9ace9f285d8

General

Target

3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe
Size

3.2MB
MD5

aa8e24d4aedd6bff11918e3df13f9a1e
SHA1

d519c6786c327f5ccee556f9a9aa8fb55690aab2
SHA256

3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10
SHA512

c288fd5cdafb2bcb47129caeb8ff29ae75dbd33f931003ac8a265f4a84f771d1fed6d3e0bd38933a1918c71e0f95d9cb9fea455df93c5c25660d138d141244e1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

pid process

2000 3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

pid	process
2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

Loads dropped DLL 4 IoCs

Processes:

3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

pid	process
476	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe
2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

Modifies registry class 207 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\SysWow64\\jscript.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact\CLSID\ = "{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript\OLESCRIPT	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\ = "JScript Language"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3\OLESCRIPT	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\OLESCRIPT	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\OLESCRIPT	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\INPROCSERVER32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1\ = "JScript Language"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1\OLESCRIPT	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript\OLEScript	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\OLEScript	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\INPROCSERVER32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript Author\ = "JScript Language Authoring"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode\OLEScript	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ = "C:\\Windows\\SysWow64\\jscript.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript Author\OLESCRIPT	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author\OLEScript	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\ = "JScript Language Encoding"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact\ = "JScript Compact Profile (ECMA 327)"	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

pid process

2000 3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

pid	process
2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp

description	pid	process	target process
PID 476 wrote to memory of 2000	476	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
PID 476 wrote to memory of 2000	476	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
PID 476 wrote to memory of 2000	476	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
PID 476 wrote to memory of 2000	476	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
PID 476 wrote to memory of 2000	476	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
PID 476 wrote to memory of 2000	476	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
PID 476 wrote to memory of 2000	476	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
PID 2000 wrote to memory of 1404	2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp	regsvr32.exe
PID 2000 wrote to memory of 1404	2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp	regsvr32.exe
PID 2000 wrote to memory of 1404	2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp	regsvr32.exe
PID 2000 wrote to memory of 1404	2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp	regsvr32.exe
PID 2000 wrote to memory of 1404	2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp	regsvr32.exe
PID 2000 wrote to memory of 1404	2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp	regsvr32.exe
PID 2000 wrote to memory of 1404	2000	3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe
"C:\Users\Admin\AppData\Local\Temp\3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:476

C:\Users\Admin\AppData\Local\Temp\is-SP2IN.tmp\3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
"C:\Users\Admin\AppData\Local\Temp\is-SP2IN.tmp\3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp" /SL5="$20156,2904423,148992,C:\Users\Admin\AppData\Local\Temp\3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\jscript.dll"
3⤵
- Modifies registry class
PID:1404

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-SP2IN.tmp\3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
MD5
5b207d2d21947b4620176ea8b3cca1ef

SHA1
6142bd5d31b795cb8b5c924e4f2d8988ab83f717

SHA256
b0e2dbb3d483e7e792fecce56f3e56c718dfe0953c2148e2a309a6872f97fc94

SHA512
271f8e4d71affef979f08f7ba0e1a74a7a27425e5f3618c4983cedfb289d744287d3ec940e6d14ccca72462c118009d8d7b321df642235fd23ab17785c973c58

Download Submit
\Users\Admin\AppData\Local\Temp\is-H7QKM.tmp\_isetup\_iscrypt.dll
MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-H7QKM.tmp\_isetup\_shfoldr.dll
MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-H7QKM.tmp\_isetup\_shfoldr.dll
MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-SP2IN.tmp\3f6324920b3667fdb510031cc0c53cf5dee6374e7db76efd299c6d556c33eb10.tmp
MD5
5b207d2d21947b4620176ea8b3cca1ef

SHA1
6142bd5d31b795cb8b5c924e4f2d8988ab83f717

SHA256
b0e2dbb3d483e7e792fecce56f3e56c718dfe0953c2148e2a309a6872f97fc94

SHA512
271f8e4d71affef979f08f7ba0e1a74a7a27425e5f3618c4983cedfb289d744287d3ec940e6d14ccca72462c118009d8d7b321df642235fd23ab17785c973c58

Download Submit
memory/1404-8-0x0000000000000000-mapping.dmp

Download
memory/2000-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads