194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97

General

Target

194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Size

397KB
MD5

b7a516168f609affb770595b12aa73aa
SHA1

eb4cc9682e8b3b1fdc233b5159f72364d0fe7af5
SHA256

194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97
SHA512

ee6b518081a481c9a2b080f9f94aa67e8bb17f5ac7347dcf63252f7387fabc12d8a94397f0b8014df6b4fb42101170dc6fea58f41e885d268e50d1f5191db425
SSDEEP

6144:N46j0bE9UUFAVKZqWLm1uMwP+eEZsf7pZeNyWj8eCj4BOi3jx9:N9j+E9UgqW6ZsfDoyQCj4YQl9

Score

9^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jziFE5A.tmp	acprotect
C:\Users\Admin\AppData\Local\Temp\jziFE5A.tmp	acprotect

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\ = "Microsoft Windows Media Player 12.0"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

Loads dropped DLL 2 IoCs

Processes:

194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

pid	process
4648	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
4648	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Compatibility Flags = "32"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

Modifies registry class 64 IoCs

Processes:

194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F40-D5C8-11D0-A520-145405C10000}	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{C69E8F40-D5C8-11D0-A520-145405C10000}\FriendlyName = "IVF source filter"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMS	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asx	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.nsc = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex\ContextMenuHandlers\WMPBurnAudioCD\ = "{8DD448E6-C188-4aed-AF92-44956194EB1F}"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{C69E8F40-D5C8-11D0-A520-145405C10000}\CLSID = "{C69E8F40-D5C8-11D0-A520-145405C10000}"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex\ContextMenuHandlers	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\Extensions\.IVF = "{C69E8F40-D5C8-11D0-A520-145405C10000}"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ivf\CLSID = "{05589FA1-C356-11CE-BF01-00AA0055595A}"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F41-D5C8-11D0-A520-145405C10000}\InprocServer32	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u\SubType = "{a98c8400-4181-11d1-a520-00a0d10129c0}"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmx	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\Extensions	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IVFfile\shell\open\command	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.asx = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F40-D5C8-11D0-A520-145405C10000}\InprocServer32\ = "C:\\Windows\\SysWow64\\ivfsrc.ax"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMS\Animation = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wvx	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F40-D5C8-11D0-A520-145405C10000}\ = "Indeo Video (r) 5.1 Progressive Download Source"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F40-D5C8-11D0-A520-145405C10000}\InprocServer32	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F43-D5C8-11D0-A520-145405C10000}\InprocServer32\ThreadingModel = "Both"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex\ContextMenuHandlers	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F42-D5C8-11D0-A520-145405C10000}\InprocServer32	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asf\Animation = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wma = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{6B6D0800-9ADA-11D0-A520-00A0D10129C0}\0 = "0,14,,50ef8119b3bdd011a3e500a0c924"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmv\Animation = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{6B6D0800-9ADA-11D0-A520-00A0D10129C0}	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IVFfile\shell\open\command\ = "RunDll32.exe C:\\Windows\\SysWOW64\\wmpdxm.dll,RunDll /play %1"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{6B6D0800-9ADA-11D0-A520-00A0D10129C0}\Source Filter = "{C69E8F40-D5C8-11D0-A520-145405C10000}"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IVFfile\shell\close\command\ = "RunDll32.exe C:\\Windows\\SysWOW64\\wmpdxm.dll,RunDll /play %1"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F43-D5C8-11D0-A520-145405C10000}	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions\AU	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u\Media Type = "{e436eb83-524f-11ce-9f53-0020af0ba770}"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wm	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wax = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u\Source Filter = "{e436ebb5-524f-11ce-9f53-0020af0ba770}"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ivf	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ivf\Extension = ".IVF"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{083863F1-70DE-11d0-BD40-00A0C911CE86}	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F41-D5C8-11D0-A520-145405C10000}\InprocServer32\ = "C:\\Windows\\SysWow64\\ivfsrc.ax"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F43-D5C8-11D0-A520-145405C10000}\InprocServer32	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.IVF\Content Type = "video/x-ivf"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F43-D5C8-11D0-A520-145405C10000}\ = "Indeo Video (r) 5.1 Progressive Download Source Dynamic Info"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wma	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmx\Animation = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IVFfile\DefaultIcon\ = "C:\\Windows\\SysWow64\\ivfsrc.ax,0"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex\ContextMenuHandlers\WMPBurnAudioCD	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.IVF\ = "IVFfile"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wm = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wmv = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C69E8F42-D5C8-11D0-A520-145405C10000}\InprocServer32\ThreadingModel = "Both"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\RIFFHandlers\AVI	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmv	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wvx\Animation = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSM\Animation = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.asp = "dxmasf.dll,150"	194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

pid process

4648 194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe

C:\Users\Admin\AppData\Local\Temp\194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe
"C:\Users\Admin\AppData\Local\Temp\194e44e97e035f14328c3554a161b3acc524bb43737be4ab3c7e8c1815a9ed97.exe"
1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jziFE5A.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\jziFE5A.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/4648-132-0x0000000001000000-0x000000000103A000-memory.dmp

Filesize
232KB

Download
memory/4648-135-0x0000000000550000-0x00000000005C3000-memory.dmp

Filesize
460KB

Download
memory/4648-136-0x0000000001000000-0x000000000103A000-memory.dmp

Filesize
232KB

Download
memory/4648-137-0x0000000000550000-0x00000000005C3000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads