7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a

Analysis

max time kernel
117s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Size

963KB
MD5

7c744e12d32ba52dfa5e7dd75e2eba80
SHA1

0f77bdd7c1c5e7659028562caae4fa3eab1c2861
SHA256

7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a
SHA512

ca77378f86a9c555a8a718a7d09a9be45c75bf33eb4313d3fb8e5c5793176799b8c9820b10441efecc19f868d40b105f7a35209f5afcf4b529fafff8e5211a6a
SSDEEP

24576:HjTbkVZMybR2wT6aQ7j5YZLJC8xlkRwbT6hY0gaKHO/amj4:iJkwtG5mE8xQ6T6KtZms

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0009000000012677-66.dat	aspack_v212_v242
behavioral1/files/0x000700000001313e-67.dat	aspack_v212_v242
behavioral1/files/0x000700000001318e-68.dat	aspack_v212_v242
behavioral1/files/0x00070000000132e5-69.dat	aspack_v212_v242

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ILQUYch\Parameters\ServiceDll = "C:\\Program Files (x86)\\Windows NT\\5245991X.dll"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe

Deletes itself 1 IoCs

pid	Process
1236	cmd.exe

Loads dropped DLL 8 IoCs

pid	Process
1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
1280	svchost.exe
1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HkLXaVcN.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Windows\SysWOW64\HkLXaVcN.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File created	C:\Windows\SysWOW64\ir41_qcx4297652.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Windows\SysWOW64\ir41_qcx4297652.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Windows\SysWOW64\HkLXaVcN.exe	svchost.exe
File created	C:\Windows\SysWOW64\VbJQyfLRt.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Windows\SysWOW64\VbJQyfLRt.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\License4297652.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File created	C:\Program Files (x86)\Windows NT\5245991X.dll.tmp	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File created	C:\Program Files (x86)\Internet Explorer\RWafLOtWa.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RWafLOtWa.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\tRWafjN.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File created	C:\Program Files (x86)\Internet Explorer\xbftKNPSUX.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Program Files\7-Zip\License4297652.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Program Files (x86)\Windows NT\5245991X.dll	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File created	C:\Program Files (x86)\Internet Explorer\tRWafjN.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\xbftKNPSUX.exe	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\4280224A.dll.tmp	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Windows\AppCompat\4280224A.dll	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File created	C:\Windows\Tasks\SA4297652.dll.tmp	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File opened for modification	C:\Windows\Tasks\SA4297652.dll	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
File created	C:\Windows\DelA.bat	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75EA2845-EAD5-486E-A339-59FED49289A6}\	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\TypeLib	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\Version	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\open	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0\FLAGS	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\ = "iOffCalc"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\TypeLib	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\TypeLib\Version = "1.0"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ = "open"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0\0\win32\ = "C:\\Windows\\Tasks\\SA4297652.dll"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\open\command	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ = "open"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\InprocServer32\ThreadingModel = "Apartment"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\open\command\ = "C:\\Program Files\\7-Zip\\License4297652.exe \"%1\""	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\open	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\open\command	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0\HELPDIR	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\TypeLib\Version = "1.0"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\CLSID = "{75EA2845-EAD5-486E-A339-59FED49289A6}"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0\0	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\TypeLib	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\TypeLib\ = "{9B74BBC9-9516-4C06-9A9B-4594386F429D}"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75EA2845-EAD5-486E-A339-59FED49289A6}\InprocServer32\ThreadingModel = "Apartment"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\ProxyStubClsid32	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe \"%1\""	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0\FLAGS\ = "0"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OffCalc.OffCalcExt	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\open\command\ = "C:\\Program Files\\7-Zip\\License4297652.exe \"%1\""	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\ProgID	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\ProgID\ = "OffCalc.OffCalcExt"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0\0\win32	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\ = "iOffCalc"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\TypeLib\ = "{9B74BBC9-9516-4C06-9A9B-4594386F429D}"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OffCalc.OffCalcExt\Clsid	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\InprocServer32	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OffCalc.OffCalcExt\Clsid\ = "{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe \"%1\""	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75EA2845-EAD5-486E-A339-59FED49289A6}	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75EA2845-EAD5-486E-A339-59FED49289A6}\InprocServer32\ = "C:\\Windows\\AppCompat\\4280224A.dll"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0\HELPDIR\ = "C:\\Windows\\Tasks\\"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OffCalc.OffCalcExt\	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\Version\ = "1.0"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}\1.0\ = "MicCalc Library"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C563030-29AA-496A-85F9-2A91F3A7D203}\ProxyStubClsid32	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\InprocServer32\ = "C:\\Windows\\Tasks\\SA4297652.dll"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75EA2845-EAD5-486E-A339-59FED49289A6}\InprocServer32	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9B74BBC9-9516-4C06-9A9B-4594386F429D}	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C80F2C34-B4A7-4F23-A99E-D55DB29DC30D}\TypeLib\ = "{9B74BBC9-9516-4C06-9A9B-4594386F429D}"	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
560	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1280	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1236	1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe	30
PID 1928 wrote to memory of 1236	1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe	30
PID 1928 wrote to memory of 1236	1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe	30
PID 1928 wrote to memory of 1236	1928	7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe	30
PID 1236 wrote to memory of 560	1236	cmd.exe	31
PID 1236 wrote to memory of 560	1236	cmd.exe	31
PID 1236 wrote to memory of 560	1236	cmd.exe	31
PID 1236 wrote to memory of 560	1236	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe
"C:\Users\Admin\AppData\Local\Temp\7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\DelA.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:560

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k hKNQTW
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\DelA.bat

Filesize
285B

MD5
22009fbff32bba907cabaccc23cb1f95

SHA1
cc1285cb8c886b4a331949e2a9aa8effdf205a5b

SHA256
3c452c042eefd269800089dae607e260563c428686065bc369a99a3d85943ebd

SHA512
59cf1452a35072245b496306886885a1c937cb7437be65758965470f6557ebfebc8dce2c7bdd1023660eff9ca5e6bc92e8874106a394d344a555cd525e7cb9a6

Download Submit
C:\Windows\SysWOW64\HkLXaVcN.exe

Filesize
613B

MD5
e40431bd876cd5e91f0b05b9e76e9d68

SHA1
9d3b8b67fec6e262ac8964face8c4a0195c66f1a

SHA256
da01b3156ba48a19d8e0df404277ff6892948e26311fded95f8ae7dcac5609dd

SHA512
97cbd9ef2998be3f356c6f2f55a3617796bbeb544f894ae2e3d143d68f3cf8c1f08acc8272b2aa67dc50b2dd689517eaf972cf6e31dc0db1f2f7c68fe4263ea5

Download Submit
C:\Windows\SysWOW64\HkLXaVcN.exe

Filesize
613B

MD5
e40431bd876cd5e91f0b05b9e76e9d68

SHA1
9d3b8b67fec6e262ac8964face8c4a0195c66f1a

SHA256
da01b3156ba48a19d8e0df404277ff6892948e26311fded95f8ae7dcac5609dd

SHA512
97cbd9ef2998be3f356c6f2f55a3617796bbeb544f894ae2e3d143d68f3cf8c1f08acc8272b2aa67dc50b2dd689517eaf972cf6e31dc0db1f2f7c68fe4263ea5

Download Submit
\??\c:\program files (x86)\windows nt\5245991x.dll

Filesize
726KB

MD5
c9716a7e81808fa5767877534b3da393

SHA1
a2b8b74ad4d2c98371c21c033049b769edc218f5

SHA256
e5d4473528dc0a07571a995a33bc83a4e9b61de04ca839ac639c740f5fde70dc

SHA512
a2009d801721c75baae9bf5bc35d8eaf1c997b3070aa878ccf0b1bc23788274b644965eb9f3c26b204735c416d47f2d702b3722fda8f138cc8b29c7d9975934e

Download Submit
\Program Files (x86)\Internet Explorer\RWafLOtWa.exe

Filesize
963KB

MD5
7c744e12d32ba52dfa5e7dd75e2eba80

SHA1
0f77bdd7c1c5e7659028562caae4fa3eab1c2861

SHA256
7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a

SHA512
ca77378f86a9c555a8a718a7d09a9be45c75bf33eb4313d3fb8e5c5793176799b8c9820b10441efecc19f868d40b105f7a35209f5afcf4b529fafff8e5211a6a

Download Submit
\Program Files (x86)\Internet Explorer\tRWafjN.exe

Filesize
963KB

MD5
7c744e12d32ba52dfa5e7dd75e2eba80

SHA1
0f77bdd7c1c5e7659028562caae4fa3eab1c2861

SHA256
7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a

SHA512
ca77378f86a9c555a8a718a7d09a9be45c75bf33eb4313d3fb8e5c5793176799b8c9820b10441efecc19f868d40b105f7a35209f5afcf4b529fafff8e5211a6a

Download Submit
\Program Files (x86)\Internet Explorer\xbftKNPSUX.exe

Filesize
963KB

MD5
7c744e12d32ba52dfa5e7dd75e2eba80

SHA1
0f77bdd7c1c5e7659028562caae4fa3eab1c2861

SHA256
7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a

SHA512
ca77378f86a9c555a8a718a7d09a9be45c75bf33eb4313d3fb8e5c5793176799b8c9820b10441efecc19f868d40b105f7a35209f5afcf4b529fafff8e5211a6a

Download Submit
\Program Files (x86)\Windows NT\5245991X.dll

Filesize
726KB

MD5
c9716a7e81808fa5767877534b3da393

SHA1
a2b8b74ad4d2c98371c21c033049b769edc218f5

SHA256
e5d4473528dc0a07571a995a33bc83a4e9b61de04ca839ac639c740f5fde70dc

SHA512
a2009d801721c75baae9bf5bc35d8eaf1c997b3070aa878ccf0b1bc23788274b644965eb9f3c26b204735c416d47f2d702b3722fda8f138cc8b29c7d9975934e

Download Submit
\Program Files (x86)\Windows NT\5245991X.dll

Filesize
726KB

MD5
c9716a7e81808fa5767877534b3da393

SHA1
a2b8b74ad4d2c98371c21c033049b769edc218f5

SHA256
e5d4473528dc0a07571a995a33bc83a4e9b61de04ca839ac639c740f5fde70dc

SHA512
a2009d801721c75baae9bf5bc35d8eaf1c997b3070aa878ccf0b1bc23788274b644965eb9f3c26b204735c416d47f2d702b3722fda8f138cc8b29c7d9975934e

Download Submit
\Windows\AppCompat\4280224A.dll

Filesize
946KB

MD5
954e79eff0ce60e942aea0db3afd9a72

SHA1
24a91494848b021bfe5ad1c6a65455ccf3de0c02

SHA256
bf1ed4fc485cfbf7bd469ab94d80b27d8adfecbf72d98e30d31f74c50654f271

SHA512
11c770d812274c702df58cb1501364f04386d5e7cfeb7a8daedaccdc877f22f5d0ef22f614102fd4e300a3a7405e04c01b9bb20c383a4dc4619606267e7d02d2

Download Submit
\Windows\SysWOW64\VbJQyfLRt.exe

Filesize
963KB

MD5
7c744e12d32ba52dfa5e7dd75e2eba80

SHA1
0f77bdd7c1c5e7659028562caae4fa3eab1c2861

SHA256
7c5ccd2f3279bad7e7494a6a0b592096ef280aab1aa03589b02c89a045276b6a

SHA512
ca77378f86a9c555a8a718a7d09a9be45c75bf33eb4313d3fb8e5c5793176799b8c9820b10441efecc19f868d40b105f7a35209f5afcf4b529fafff8e5211a6a

Download Submit
\Windows\Tasks\SA4297652.dll

Filesize
707KB

MD5
fb77dd216ab8bf37ff11bb7ebc2a1a8d

SHA1
4905a80f1de0330db5dbc0c868b652b75d8c2676

SHA256
0a1b87ea292859939084983d8babd57ed10944cf4c4409b68bc822c609ac452e

SHA512
51b00f2b26669823e63e7ba19bb18162853383a306e2de67bad258114b51cf59b956970dc2a1f570821e8254b085b1bf11284ae28274dca91174c048ea805b07

Download Submit
memory/1280-63-0x0000000002240000-0x00000000022FC000-memory.dmp

Filesize
752KB

Download
memory/1928-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1928-60-0x00000000021E0000-0x000000000229C000-memory.dmp

Filesize
752KB

Download
memory/1928-58-0x0000000000710000-0x00000000007C7000-memory.dmp

Filesize
732KB

Download
memory/1928-56-0x0000000002F00000-0x0000000002FF2000-memory.dmp

Filesize
968KB

Download