746de725b958eb6dc30b836114a79cb0071fda04a15dcc938a6ced5586de25d0

Analysis

max time kernel
152s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ipacc/ipacc.exe
Size

2.7MB
MD5

59e1fe6e03698ed318553bcb27459714
SHA1

926c6eb147771e33da7033b1bc1984d02fecbd19
SHA256

4997b44eba96f208d739842bfab5ba42d6d403f5be934074f9fb5ebabbb735b2
SHA512

a5ff4fc6baabfc751c8f6f1d48d7730acb702d003d399a8a2d3f24588f10a98ad5fd4d29fac44d8f9fb9e957c32a8746f8b6331e2778edefa89a989d99510937
SSDEEP

49152:4FRLGah4x9y9Ks2DOWyvAKM7QEBno8lP3NThjwTJ4ORdaHzHKA:4FRcyfAQEBo8lPi4ORd6t

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeipacc.exe

pid process

1600 regsvr32.exe
1660 ipacc.exe
1660 ipacc.exe

pid	process
1600	regsvr32.exe
1660	ipacc.exe
1660	ipacc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ipacc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	ipacc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ipacc.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ipacc\\ipacc.exe\""	ipacc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

ipacc.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 ipacc.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	ipacc.exe

Drops file in System32 directory 6 IoCs

Processes:

ipacc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\romspring.dat	ipacc.exe
File created	C:\Windows\SysWOW64\com\PopShow.dll	ipacc.exe
File opened for modification	C:\Windows\SysWOW64\romarshal.dat	ipacc.exe
File opened for modification	C:\Windows\SysWOW64\mprmsgse.axz	ipacc.exe
File created	C:\Windows\SysWOW64\ipacc_v2.dll	ipacc.exe
File opened for modification	C:\Windows\SysWOW64\ipacc_v2.dll	ipacc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

944 ipconfig.exe
2000 ipconfig.exe

pid	process
944	ipconfig.exe
2000	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

ipacc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ipacc.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	ipacc.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ipacc.exe

Modifies registry class 46 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\com\\PopShow.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView\ = "ADView Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView\CLSID\ = "{506A03CA-F1B5-4367-AB31-52C0C8420C46}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\ = "ADView Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\TypeLib\ = "{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\ = "IADView"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\PopShow.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\TypeLib\ = "{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView.1\CLSID\ = "{506A03CA-F1B5-4367-AB31-52C0C8420C46}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\VersionIndependentProgID\ = "PopShow.ADView"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0\ = "PopShow 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView.1\ = "ADView Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView\CurVer\ = "PopShow.ADView.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\ProgID\ = "PopShow.ADView.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\TypeLib\ = "{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\com"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\ = "IADView"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE260095-D9A4-4BF8-AC2C-3E45DCE63178}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PopShow.ADView	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{506A03CA-F1B5-4367-AB31-52C0C8420C46}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{138E0D0C-9C78-493E-84EB-8900EBBB1A6B}	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1252	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1252	AUDIODG.EXE
Token: 33	1252	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1252	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

ipacc.exe

pid	process
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

ipacc.exe

pid	process
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe
1660	ipacc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ipacc.exe

pid process

1660 ipacc.exe
1660 ipacc.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ipacc.exe

description	pid	process	target process
PID 1660 wrote to memory of 944	1660	ipacc.exe	ipconfig.exe
PID 1660 wrote to memory of 944	1660	ipacc.exe	ipconfig.exe
PID 1660 wrote to memory of 944	1660	ipacc.exe	ipconfig.exe
PID 1660 wrote to memory of 944	1660	ipacc.exe	ipconfig.exe
PID 1660 wrote to memory of 1600	1660	ipacc.exe	regsvr32.exe
PID 1660 wrote to memory of 1600	1660	ipacc.exe	regsvr32.exe
PID 1660 wrote to memory of 1600	1660	ipacc.exe	regsvr32.exe
PID 1660 wrote to memory of 1600	1660	ipacc.exe	regsvr32.exe
PID 1660 wrote to memory of 1600	1660	ipacc.exe	regsvr32.exe
PID 1660 wrote to memory of 1600	1660	ipacc.exe	regsvr32.exe
PID 1660 wrote to memory of 1600	1660	ipacc.exe	regsvr32.exe
PID 1660 wrote to memory of 2000	1660	ipacc.exe	ipconfig.exe
PID 1660 wrote to memory of 2000	1660	ipacc.exe	ipconfig.exe
PID 1660 wrote to memory of 2000	1660	ipacc.exe	ipconfig.exe
PID 1660 wrote to memory of 2000	1660	ipacc.exe	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\ipacc\ipacc.exe
"C:\Users\Admin\AppData\Local\Temp\ipacc\ipacc.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
2⤵
- Gathers network information
PID:944

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\com\PopShow.dll /s
2⤵
- Loads dropped DLL
- Modifies registry class
PID:1600

C:\Windows\SysWOW64\ipconfig.exe
ipconfig
2⤵
- Gathers network information
PID:2000

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1252

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\com\PopShow.dll
Filesize
40KB

MD5
ed6949d75273ce92606ebb3cab4cda9f

SHA1
53821fc4a51b478fb91573a33d1448af1cf05981

SHA256
8fe9569a41216d273bce3104d1960bf985be56c8a0c6808e9570329fcef7f4b7

SHA512
5f2079f97a3aa33675b21cbfed12f95d9f6baf9546b1a0d57afb293789ae798705ad3bbb0af83f33481bff90ed02bd0f3e74e2429e5639b0d215c17e6983afb5

Download Submit
\Windows\SysWOW64\com\PopShow.dll
Filesize
40KB

MD5
ed6949d75273ce92606ebb3cab4cda9f

SHA1
53821fc4a51b478fb91573a33d1448af1cf05981

SHA256
8fe9569a41216d273bce3104d1960bf985be56c8a0c6808e9570329fcef7f4b7

SHA512
5f2079f97a3aa33675b21cbfed12f95d9f6baf9546b1a0d57afb293789ae798705ad3bbb0af83f33481bff90ed02bd0f3e74e2429e5639b0d215c17e6983afb5

Download Submit
\Windows\SysWOW64\ipacc_v2.dll
Filesize
56KB

MD5
a4a8d010f957ef326705c513b0af9d28

SHA1
18bc9ff8de553ecff2b9dfe7a3d51155c7021d8c

SHA256
559786764ee95af3e56a31b862600dd982ed057c1226f5b8a211c6fad5c7430f

SHA512
a3ef6af36aab829775fed76f6a07f87757ed4489fd3769ca916b5a7f9772c7f261867d52547400ceba343fc296acd48ce61c1748553b8cfc4a2591ac7713d77f

Download Submit
\Windows\SysWOW64\ipacc_v2.dll
Filesize
56KB

MD5
a4a8d010f957ef326705c513b0af9d28

SHA1
18bc9ff8de553ecff2b9dfe7a3d51155c7021d8c

SHA256
559786764ee95af3e56a31b862600dd982ed057c1226f5b8a211c6fad5c7430f

SHA512
a3ef6af36aab829775fed76f6a07f87757ed4489fd3769ca916b5a7f9772c7f261867d52547400ceba343fc296acd48ce61c1748553b8cfc4a2591ac7713d77f

Download Submit
memory/944-61-0x0000000000000000-mapping.dmp

Download
memory/1600-62-0x0000000000000000-mapping.dmp

Download
memory/1660-58-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1660-59-0x0000000000720000-0x000000000075E000-memory.dmp

Filesize
248KB

Download
memory/1660-54-0x0000000000020000-0x0000000000038000-memory.dmp

Filesize
96KB

Download
memory/1660-56-0x00000000006C0000-0x0000000000715000-memory.dmp

Filesize
340KB

Download
memory/1660-70-0x0000000002BE0000-0x0000000002BEF000-memory.dmp

Filesize
60KB

Download
memory/1660-55-0x00000000003D0000-0x00000000003EB000-memory.dmp

Filesize
108KB

Download
memory/2000-67-0x0000000000000000-mapping.dmp

Download