1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4

General

Target

1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
Size

16KB
MD5

44973f579d81ccbe000d322fdb93b620
SHA1

cc19104824054d3268fa9cf3a067b5c7f628a0de
SHA256

1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4
SHA512

acd0992f28765c71f25221efe0f9a42558a213e45d1cf6a90d7a218f79774b8461834319372a3afb0cd99faaa4c697f4296e782af3259bf8ddc65d6af8b45e04
SSDEEP

384:x3MoTmrrDA+jjW0YW+HmY/xgcowDH6AG5Ib8WOHm6ihNUD7gsqJ5shshLqkT4xK5:+g+3i/tfhKfitqR

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

Processes:

1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\cmmon32.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\compact.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\dplaysvr.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\RunLegacyCPLElevated.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\SndVol.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\wowreg32.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\ftp.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\RegisterIEPKEYs.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\tcmsetup.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\user.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\wextract.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\OptionalFeatures.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\cliconfg.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\help.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\MigAutoPlay.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\netsh.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_isv.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\taskeng.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\ComputerDefaults.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\instnm.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\odbcconf.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\setx.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\systray.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\diskpart.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\gpscript.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\hh.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\waitfor.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\WSManHTTPConfig.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\diskraid.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\mobsync.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\msdt.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\resmon.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\sxstrace.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\autofmt.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\dvdplay.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\MRINFO.EXE	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\perfhost.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\relog.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\WPDShextAutoplay.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\cacls.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\dvdupgrd.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\proquota.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\wsmprovhost.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\clip.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\Dism.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\ieUnatt.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\systeminfo.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesRemote.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\certutil.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\charmap.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\comp.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\fixmapi.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\regedt32.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\sort.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\tasklist.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\dpapimig.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\runas.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\SysWOW64\DpiScaling.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe

Drops file in Windows directory 11 IoCs

Processes:

1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe

description	ioc	process
File opened for modification	C:\Windows\splwow64.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\twunk_32.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\bfsvc.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\explorer.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\HelpPane.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\hh.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\notepad.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\fveupdate.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\twunk_16.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\winhlp32.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
File opened for modification	C:\Windows\write.exe	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe

C:\Users\Admin\AppData\Local\Temp\1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe
"C:\Users\Admin\AppData\Local\Temp\1b7e5f2f0eec39087e026e3932c44791a5ef21a29636ab34303026d718449db4.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Enumerates system info in registry
PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-54-0x0000000001000000-0x0000000001006B00-memory.dmp

Filesize
26KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads