Analysis
-
max time kernel
162s -
max time network
231s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:51
Static task
static1
Behavioral task
behavioral1
Sample
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe
Resource
win7-20221111-en
General
-
Target
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe
-
Size
1.8MB
-
MD5
844ae729e51154cd161ecc3b9addc20d
-
SHA1
93f671334d4838cd6e3f632dd21dfae47fc742b5
-
SHA256
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e
-
SHA512
cf5324caf2aef459afd2630a0b4f8fff6a6e8e10c0bfa16c58de9a0c3832ae1179bb8b745b18f2641516d319b285dd44e7b64a7b27e1723b8cc19cd3593e19cd
-
SSDEEP
49152:Vb9j4giaUnc+cKsyn1bnen3gjAX61cVwmc+UmHkK7OSlzS:jBiaUnc/Kh1benQm614wIUmEPSlzS
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exepid process 1872 regsvr32.exe 1328 regsvr32.exe 948 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe -
Installs/modifies Browser Helper Object 2 TTPs 14 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 5 IoCs
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exepid process 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1824 schtasks.exe 1800 schtasks.exe 188 schtasks.exe 972 schtasks.exe -
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID\ = "FoxPro.FoxPro.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL\AppID = "{6DD1B906-45FA-4A57-9AC6-01108C25067F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ = "IFoxProBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID\ = "FoxPro.FoxPro" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer\ = "FoxPro.FoxPro.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL\AppID = "{6DD1B906-45FA-4A57-9AC6-01108C25067F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID\ = "FoxPro.FoxPro.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ = "IFoxProBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\ = "FoxPro 3.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer\ = "FoxPro.FoxPro.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID\ = "FoxPro.FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F}\ = "FoxPro" regsvr32.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exepid process 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exedescription pid process Token: SeIncBasePriorityPrivilege 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exeregsvr32.exedescription pid process target process PID 1000 wrote to memory of 992 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 992 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 992 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 992 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1824 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1824 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1824 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1824 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1096 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1096 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1096 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1096 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1800 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1800 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1800 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1800 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1328 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1328 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1328 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1328 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1328 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1328 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1328 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1872 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1872 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1872 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1872 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1872 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1872 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1000 wrote to memory of 1872 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe regsvr32.exe PID 1872 wrote to memory of 948 1872 regsvr32.exe regsvr32.exe PID 1872 wrote to memory of 948 1872 regsvr32.exe regsvr32.exe PID 1872 wrote to memory of 948 1872 regsvr32.exe regsvr32.exe PID 1872 wrote to memory of 948 1872 regsvr32.exe regsvr32.exe PID 1872 wrote to memory of 948 1872 regsvr32.exe regsvr32.exe PID 1872 wrote to memory of 948 1872 regsvr32.exe regsvr32.exe PID 1872 wrote to memory of 948 1872 regsvr32.exe regsvr32.exe PID 1000 wrote to memory of 1700 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe reg.exe PID 1000 wrote to memory of 1700 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe reg.exe PID 1000 wrote to memory of 1700 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe reg.exe PID 1000 wrote to memory of 1700 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe reg.exe PID 1000 wrote to memory of 1596 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe iexplore.exe PID 1000 wrote to memory of 1596 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe iexplore.exe PID 1000 wrote to memory of 1596 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe iexplore.exe PID 1000 wrote to memory of 1596 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe iexplore.exe PID 1000 wrote to memory of 432 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 432 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 432 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 432 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 188 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 188 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 188 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 188 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1256 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1256 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1256 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 1256 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 972 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 972 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 972 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 972 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe schtasks.exe PID 1000 wrote to memory of 980 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe cmd.exe PID 1000 wrote to memory of 980 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe cmd.exe PID 1000 wrote to memory of 980 1000 eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe cmd.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} = "1" eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe"C:\Users\Admin\AppData\Local\Temp\eb0deb25600ed4bd927e310f825278f412178e91523c38215555ef5f55aa568e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "4CEFD9B73D6C-1CRMOI2" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe" /SC DAILY /TN "4CEFD9B73D6C-1CRMOI2" /ST 17:27:00 /du 0024:00 /RI 360 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "5FOFD9B73D6C-2CRMOI6" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe" /SC ONIDLE /TN "5FOFD9B73D6C-2CRMOI6" /I 1 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\NoVooITSet /v default /t reg_sz /d 12⤵
- Modifies registry key
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.acdcads.com/aff/thanks/updater-thanks.php?t=1386580451&wti=1000&s=1000&sta=1&av=None2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "mium0d" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe" /SC ONLOGON /TN "mium0d" /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "keepup" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe" /SC DAILY /TN "keepup" /ST 13:40:00 /du 0024:00 /RI 10 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EB0DEB~1.EXE > nul2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dllFilesize
182KB
MD5ce31a05ee7c72fea9ea74dcc1a16e8d6
SHA1e524c0f68b735138174137a034f5b5f7878917fb
SHA2561a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f
SHA512a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dllFilesize
182KB
MD5ce31a05ee7c72fea9ea74dcc1a16e8d6
SHA1e524c0f68b735138174137a034f5b5f7878917fb
SHA2561a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f
SHA512a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
memory/188-79-0x0000000000000000-mapping.dmp
-
memory/432-78-0x0000000000000000-mapping.dmp
-
memory/948-75-0x000007FEFB561000-0x000007FEFB563000-memory.dmpFilesize
8KB
-
memory/948-74-0x0000000000000000-mapping.dmp
-
memory/972-81-0x0000000000000000-mapping.dmp
-
memory/980-82-0x0000000000000000-mapping.dmp
-
memory/992-59-0x0000000000000000-mapping.dmp
-
memory/1000-67-0x0000000000400000-0x00000000017FC000-memory.dmpFilesize
20.0MB
-
memory/1000-56-0x0000000075441000-0x0000000075443000-memory.dmpFilesize
8KB
-
memory/1000-60-0x0000000000400000-0x00000000017FC000-memory.dmpFilesize
20.0MB
-
memory/1000-84-0x0000000076EC0000-0x0000000077040000-memory.dmpFilesize
1.5MB
-
memory/1000-58-0x0000000076EC0000-0x0000000077040000-memory.dmpFilesize
1.5MB
-
memory/1000-66-0x0000000076EC0000-0x0000000077040000-memory.dmpFilesize
1.5MB
-
memory/1000-83-0x0000000000400000-0x00000000017FC000-memory.dmpFilesize
20.0MB
-
memory/1000-55-0x0000000000400000-0x00000000017FC000-memory.dmpFilesize
20.0MB
-
memory/1000-54-0x0000000000400000-0x00000000017FC000-memory.dmpFilesize
20.0MB
-
memory/1096-62-0x0000000000000000-mapping.dmp
-
memory/1256-80-0x0000000000000000-mapping.dmp
-
memory/1328-64-0x0000000000000000-mapping.dmp
-
memory/1700-77-0x0000000000000000-mapping.dmp
-
memory/1800-63-0x0000000000000000-mapping.dmp
-
memory/1824-61-0x0000000000000000-mapping.dmp
-
memory/1872-65-0x0000000000000000-mapping.dmp