bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369

General

Target

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Size

44KB
MD5

4f453f85983c414469d969d02c0b2a00
SHA1

e619e3c5ec9c8ad4fd84e293953b0fd2ee062cc1
SHA256

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369
SHA512

41ed61a49c0182567386b0468150fef135a833d57140160b6bf319955ca87001d9971d657362147b51686b1d3f24b9b08085e931c554e227d80a8122f94cec99
SSDEEP

768:s/5KlU+GX4puve9T+RnmxuGFQPk52jngbHsMztGLk6E39:Y+GeN6u2ssMztGLk13

Score

8^/10

evasion persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1 = "Jibanu.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

Blocks application from running via registry modification 58 IoCs

Adds application to list of disallowed applications.

evasion

Processes:

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "VPTray.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "ccSetMgr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgupsvc.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "mcagent.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\26 = "nod32.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\27 = "nod32kui.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.com"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "vptray.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "mcagent.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "avgsetup.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avp.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgupsvc.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgemc.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "mcvsescn.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ccEvtMgr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgamsvr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "mcvsescn.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "DefWatch.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "mcshield.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "mcregwiz.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rtvscan.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "mcvsrte.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "mcmnhdlr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.com"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "mcvsshld.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "VPTray.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "mcregwiz.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "mghtml.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "DefWatch.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "mcregwiz.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "mcregwiz.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "mcvsescn.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "mcappins.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "mcagent.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "mcagent.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "vptray.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgemc.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "mcvsrte.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ccEvtMgr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "mcmnhdlr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\26 = "nod32.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rtvscan.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "mcvsescn.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "avgsetup.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\27 = "nod32kui.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "ccSetMgr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgamsvr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "VPC32.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\28 = "pavprsrv.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "mcshield.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "mcappins.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "mghtml.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "VPC32.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\28 = "pavprsrv.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avp.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "mcvsshld.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

Disables Task Manager via registry modification
evasion

Drops file in System32 directory 3 IoCs

Processes:

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Jibanu.exe	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
File opened for modification	C:\Windows\SysWOW64\Jibanu.exe	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
File created	C:\Windows\SysWOW64\xFile.com	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

pid	process
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
2468	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

pid process

2468 bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

System policy modification 1 TTPs 31 IoCs

evasion

Modify Registry

T1112

Processes:

bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rtvscan.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "vptray.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\27 = "nod32kui.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.com"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "mcvsescn.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "mcagent.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "DefWatch.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "mcvsrte.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "mghtml.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ccEvtMgr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "avgsetup.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "mcregwiz.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "mcmnhdlr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgupsvc.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgemc.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "mcshield.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "mcregwiz.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "VPTray.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "VPC32.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "mcvsescn.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\26 = "nod32.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "mcvsshld.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "mcappins.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avp.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "ccSetMgr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\28 = "pavprsrv.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgamsvr.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "mcagent.exe"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisallowRun = "1"	bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe

C:\Users\Admin\AppData\Local\Temp\bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe
"C:\Users\Admin\AppData\Local\Temp\bb7d581ed68ea4cd2766e302a7f18bf96a1f1ca1166b2854e0c433b48eec8369.exe"
1⤵
- Adds policy Run key to start application
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-132-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2468-135-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads