Analysis
-
max time kernel
188s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 18:30
Static task
static1
Behavioral task
behavioral1
Sample
a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe
-
Size
240KB
-
MD5
066d57db6c27977a1d2c8d0301e45cdd
-
SHA1
afa1408ab30df0a0bff9dda5ab757843188e9c59
-
SHA256
a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f
-
SHA512
9d7a78a7f193229356ede2f9769947d19008614090f168260b8c0cbf7dbf338d551c29d4e1c0b8c3b6ac808c8454c0fc352786b348ba96694f65991dd2fe6e89
-
SSDEEP
6144:MHfZrlJLnDfo8O9v12v8riQBfTor8al8rJwNkVsuaRaU6mHG:MHb10aRz6mHG
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe -
Loads dropped DLL 2 IoCs
pid Process 5040 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe 5040 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CTFMON.EXE = "C:\\WINDOWS\\system32\\\u00a0ctfmon.exe" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe -
Drops autorun.inf file 1 TTPs 21 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\e:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created \??\h:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created \??\k:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created \??\c:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created \??\f:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created \??\i:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\j:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created \??\j:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\i:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\c:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\d:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created \??\e:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\f:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\g:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created \??\g:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\h:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification D:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created D:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification \??\k:\Autorun.inf a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\MSWINSCK.OCX a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File created C:\WINDOWS\SysWOW64\ ctfmon.exe a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe File opened for modification C:\WINDOWS\SysWOW64\ ctfmon.exe a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win32.dll a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\Mswinsck.ocx, 1" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\Mswinsck.ocx" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\Mswinsck.ocx" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\Mswinsck.ocx" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5040 a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe"C:\Users\Admin\AppData\Local\Temp\a7e4e7b04eee9442ccd2022ddc6187d017764a212144efbf6cd995c6568cc08f.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0