aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c

General

Target

aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Size

352KB
MD5

64c3606a8bc9cbb1708fb3dbe8ffd0c1
SHA1

81273933050e06aaf19972e9f089e140c42516da
SHA256

aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c
SHA512

896f9365e4833b37f39a3819cd9c36d2d5671406bbc1f646a99977130a06317617ee5d1fec9113ff509c251eabc6d1d71928139140d89039b874b399379433e4
SSDEEP

6144:ExgEVdGJoM4PYJ6fQy++AIw8ZqqJn+aCyIK3ccnMxjOFUd:OgSWorYJqQMzfpW1K3Dns3d

Score

1^/10

Malware Config

Signatures

Modifies registry class 59 IoCs

Processes:

aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\0\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\0\win64\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\Control	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\ = "OLE Automation"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\0	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\0\win32\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\Programmable\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\0\win32	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\FLAGS\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\Version	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\InprocServer32	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\InprocServer32\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\HELPDIR	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\Version\ = "1.0"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\ = "Moxalfep.Ipahkin.Bebod"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\MiscStatus\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\0\win64\ = "C:\\Windows\\SysWow64\\stdole2.tlb"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\HELPDIR	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\TypeLib	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\0\win32	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\VersionIndependentProgID	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\FLAGS	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\FLAGS\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\0\win64	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\Version\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\ProgID\ = "MsRDP.MsRDP.5"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\Programmable	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\stdole32.tlb"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\FLAGS\ = "0"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\MiscStatus\ = "0"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\0\win32\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\HELPDIR\ = "C:\\Windows\\System32"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\VersionIndependentProgID\ = "MsRDP.MsRDP"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\ = "OLE Automation"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\Control\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\0\win32\ = "C:\\Windows\\SysWOW64\\stdole2.tlb"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\VersionIndependentProgID\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\InprocServer32\ = "%systemroot%\\SysWow64\\mstscax.dll"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\HELPDIR\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\ProgID\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\HELPDIR\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\0	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\2.0\FLAGS	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\TypeLib\ = "{0948E777-6B97-252B-06FE-0D5E5895278F}"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\MiscStatus	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\ProgID	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\0\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0948E777-6B97-252B-06FE-0D5E5895278F}\1.0\FLAGS\ = "1"	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C768D1-27DD-46F6-44BF-8D5F4C317B02}\TypeLib\	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe

pid process

1664 aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe

pid	process
1664	aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe

C:\Users\Admin\AppData\Local\Temp\aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe
"C:\Users\Admin\AppData\Local\Temp\aa1c59429a48fccf189c83ba3b2c2982624980e7c900bc257a345cbeb80fb76c.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-132-0x0000000000400000-0x0000000000634000-memory.dmp

Filesize
2.2MB

Download
memory/1664-133-0x0000000000400000-0x0000000000634000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads