sality | 7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a

General

Target

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Size

2.4MB
MD5

ebdb7285b036489a12d3cc544918452e
SHA1

d6288d127bcecd24409258e38bbb85e0e72b8cb4
SHA256

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a
SHA512

eed66a8d7f51b8699993aa7637b20f8fa3f8211c5061666380cbbed1261c19fe148770520e9f867ff1d01a18d160ce9ad1feef9f9c22b85e3c29d394b12e5613

Score

10^/10

sality backdoor evasion spyware stealer trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx	acprotect
\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll	acprotect
\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll	acprotect
\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx	acprotect
\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx	acprotect

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1308-55-0x0000000002370000-0x000000000342A000-memory.dmp	upx
behavioral1/memory/1308-56-0x0000000002370000-0x000000000342A000-memory.dmp	upx
\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx	upx
\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll	upx
\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll	upx
\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx	upx
\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx	upx

Loads dropped DLL 5 IoCs

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

pid	process
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
File opened (read-only)	\??\Q:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\S:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\X:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\Y:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\J:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\P:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\Z:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\I:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\V:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\H:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\K:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\L:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\M:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\N:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\O:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\F:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\G:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\U:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\T:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\W:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\E:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened (read-only)	\??\R:	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Drops file in Program Files directory 7 IoCs

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File created	C:\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File created	C:\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Drops file in Windows directory 2 IoCs

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
File created	C:\Windows\6c1cc5	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
File opened for modification	C:\Windows\SYSTEM.INI	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Modifies registry class 64 IoCs

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0\ = "Properties,0,2"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS\ = "2"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\ = "0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\CAOSOFT_WEB_PRINT_lodop.ocx"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ = "LodopX Control"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control\	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\ = "LodopX Control"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ = "C:\\PROGRA~2\\MOUNTT~1\\Lodop\\CAOSOF~1.OCX"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\1	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid\ = "{2105C259-1E0C-4534-8141-A753534CB4CA}"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID\ = "Lodop.LodopX"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\CAOSOFT_WEB_PRINT_lodop.ocx,0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\1\ = "205201"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version\ = "6.0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\ = "Lodop"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ThreadingModel = "Apartment"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

pid	process
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	pid	process
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
Token: SeDebugPrivilege	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	pid	process	target process
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE
PID 1308 wrote to memory of 1244	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	taskhost.exe
PID 1308 wrote to memory of 1336	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Dwm.exe
PID 1308 wrote to memory of 1396	1308	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe	Explorer.EXE

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1336

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1244

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1396

C:\Users\Admin\AppData\Local\Temp\7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe
"C:\Users\Admin\AppData\Local\Temp\7da56f27684b28d655cff2fa77415685769ba39107bee982812f45a22d32bf7a.exe"
2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx

Filesize
1.5MB

MD5
9b686a7d92dbdd59d937b0529243cf7d

SHA1
bcbe1ef469b46115874fa411720aeaa0ddba4e5a

SHA256
e0c4b7ccd4eb130e3ce0f7076b73ed4c8021f495b9d5d25008615e36622d9d10

SHA512
d0ac539f2792cd13c8460c6993241d8bc429bfe8f45fd5432c74320165750455b823301bca2d264da83ff866bf767f382c8b7cbab03f8fe1591efbe0f55c3d67

Download Submit
\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx

Filesize
1.5MB

MD5
9b686a7d92dbdd59d937b0529243cf7d

SHA1
bcbe1ef469b46115874fa411720aeaa0ddba4e5a

SHA256
e0c4b7ccd4eb130e3ce0f7076b73ed4c8021f495b9d5d25008615e36622d9d10

SHA512
d0ac539f2792cd13c8460c6993241d8bc429bfe8f45fd5432c74320165750455b823301bca2d264da83ff866bf767f382c8b7cbab03f8fe1591efbe0f55c3d67

Download Submit
\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx

Filesize
1.5MB

MD5
9b686a7d92dbdd59d937b0529243cf7d

SHA1
bcbe1ef469b46115874fa411720aeaa0ddba4e5a

SHA256
e0c4b7ccd4eb130e3ce0f7076b73ed4c8021f495b9d5d25008615e36622d9d10

SHA512
d0ac539f2792cd13c8460c6993241d8bc429bfe8f45fd5432c74320165750455b823301bca2d264da83ff866bf767f382c8b7cbab03f8fe1591efbe0f55c3d67

Download Submit
\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll

Filesize
335KB

MD5
1b9dc9f9b6223652e861fd3681e5e622

SHA1
85af2a5a69344beba3d6df35cf496e3ebf57b13c

SHA256
e0d727515f8c932466285cbc3f7e88e8344813d1f6c63feebb8f5b76686911b4

SHA512
9499bb0029a8444a82a775780d4f7b9c6d690c951eb3e394a47dcdbae17442a321c01356119c2e7ba9a11854bf0c6ee8d06863fc4cc93cacd049d93f94ced73f

Download Submit
\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll

Filesize
335KB

MD5
1b9dc9f9b6223652e861fd3681e5e622

SHA1
85af2a5a69344beba3d6df35cf496e3ebf57b13c

SHA256
e0d727515f8c932466285cbc3f7e88e8344813d1f6c63feebb8f5b76686911b4

SHA512
9499bb0029a8444a82a775780d4f7b9c6d690c951eb3e394a47dcdbae17442a321c01356119c2e7ba9a11854bf0c6ee8d06863fc4cc93cacd049d93f94ced73f

Download Submit
memory/1308-54-0x0000000075261000-0x0000000075263000-memory.dmp

Filesize
8KB

Download
memory/1308-55-0x0000000002370000-0x000000000342A000-memory.dmp

Filesize
16.7MB

Download
memory/1308-56-0x0000000002370000-0x000000000342A000-memory.dmp

Filesize
16.7MB

Download
memory/1308-57-0x0000000000330000-0x0000000000332000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads