Analysis
-
max time kernel
225s -
max time network
334s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:10
Static task
static1
Behavioral task
behavioral1
Sample
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe
Resource
win7-20221111-en
General
-
Target
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe
-
Size
1.8MB
-
MD5
4f9b4bb1d3debe9c5b2ff4f4c01bea0f
-
SHA1
f5cca7a519ccd6cce5d5b846085fc9dbad0ebaee
-
SHA256
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d
-
SHA512
73def023512d6859e56cf8c96a90cd9c7b731c651c7a413b8b6b0d02c3cfb74b2176e69d404734f27307d610541b4a65b48c751579b27ff5a44dc45bd58800cd
-
SSDEEP
49152:liHb92ZsFHeMAsMpwtOALiClZ/RdCRwjZ:liHb92ZcHeF1pwcALnZ/Rd9V
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exepid process 1160 regsvr32.exe 1372 regsvr32.exe 1612 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe -
Installs/modifies Browser Helper Object 2 TTPs 14 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 5 IoCs
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe File opened for modification C:\Windows\System32\GroupPolicy bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exepid process 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1368 schtasks.exe 1596 schtasks.exe 1704 schtasks.exe 816 schtasks.exe -
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F}\ = "FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID\ = "FoxPro.FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID\ = "FoxPro.FoxPro.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ = "IFoxProBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F}\ = "FoxPro" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID\ = "FoxPro.FoxPro.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer\ = "FoxPro.FoxPro.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID\ = "FoxPro.FoxPro" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer\ = "FoxPro.FoxPro.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL\AppID = "{6DD1B906-45FA-4A57-9AC6-01108C25067F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\ = "FoxPro 3.0 Type Library" regsvr32.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exepid process 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exedescription pid process Token: SeIncBasePriorityPrivilege 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exeregsvr32.exedescription pid process target process PID 476 wrote to memory of 1312 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1312 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1312 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1312 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 816 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 816 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 816 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 816 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 300 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 300 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 300 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 300 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1368 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1368 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1368 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1368 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1372 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1372 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1372 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1372 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1372 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1372 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1372 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1160 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1160 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1160 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1160 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1160 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1160 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1160 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe regsvr32.exe PID 476 wrote to memory of 1720 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe reg.exe PID 476 wrote to memory of 1720 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe reg.exe PID 476 wrote to memory of 1720 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe reg.exe PID 476 wrote to memory of 1720 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe reg.exe PID 476 wrote to memory of 2028 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe iexplore.exe PID 476 wrote to memory of 2028 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe iexplore.exe PID 476 wrote to memory of 2028 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe iexplore.exe PID 476 wrote to memory of 2028 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe iexplore.exe PID 476 wrote to memory of 1508 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1508 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1508 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1508 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1596 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1596 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1596 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1596 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1112 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1112 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1112 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1112 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 1160 wrote to memory of 1612 1160 regsvr32.exe regsvr32.exe PID 1160 wrote to memory of 1612 1160 regsvr32.exe regsvr32.exe PID 1160 wrote to memory of 1612 1160 regsvr32.exe regsvr32.exe PID 1160 wrote to memory of 1612 1160 regsvr32.exe regsvr32.exe PID 1160 wrote to memory of 1612 1160 regsvr32.exe regsvr32.exe PID 1160 wrote to memory of 1612 1160 regsvr32.exe regsvr32.exe PID 1160 wrote to memory of 1612 1160 regsvr32.exe regsvr32.exe PID 476 wrote to memory of 1704 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1704 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1704 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1704 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe schtasks.exe PID 476 wrote to memory of 1040 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe cmd.exe PID 476 wrote to memory of 1040 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe cmd.exe PID 476 wrote to memory of 1040 476 bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe cmd.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} = "1" bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe"C:\Users\Admin\AppData\Local\Temp\bbe2ae42f5d2f5cd6c9fb7bd21685070b259325199ec79cbb7de2b4f1cc4af6d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:476 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "4CEFD9B73D6C-1CRMOI2" /f2⤵PID:1312
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe" /SC DAILY /TN "4CEFD9B73D6C-1CRMOI2" /ST 02:48:00 /du 0024:00 /RI 360 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
PID:816 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "5FOFD9B73D6C-2CRMOI6" /f2⤵PID:300
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe" /SC ONIDLE /TN "5FOFD9B73D6C-2CRMOI6" /I 1 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1368 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1372 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1612 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\NoVooITSet /v default /t reg_sz /d 12⤵
- Modifies registry key
PID:1720 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.acdcads.com/aff/thanks/updater-thanks.php?t=1386580451&wti=1000&s=1000&sta=1&av=None2⤵
- Modifies Internet Explorer settings
PID:2028 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "mium0d" /f2⤵PID:1508
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe" /SC ONLOGON /TN "mium0d" /RL HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1596 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "keepup" /f2⤵PID:1112
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe" /SC DAILY /TN "keepup" /ST 14:06:00 /du 0024:00 /RI 10 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BBE2AE~1.EXE > nul2⤵PID:1040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dllFilesize
182KB
MD5ce31a05ee7c72fea9ea74dcc1a16e8d6
SHA1e524c0f68b735138174137a034f5b5f7878917fb
SHA2561a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f
SHA512a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dllFilesize
182KB
MD5ce31a05ee7c72fea9ea74dcc1a16e8d6
SHA1e524c0f68b735138174137a034f5b5f7878917fb
SHA2561a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f
SHA512a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
memory/300-62-0x0000000000000000-mapping.dmp
-
memory/476-65-0x0000000000400000-0x00000000017F7000-memory.dmpFilesize
20.0MB
-
memory/476-84-0x0000000077A10000-0x0000000077B90000-memory.dmpFilesize
1.5MB
-
memory/476-55-0x0000000076931000-0x0000000076933000-memory.dmpFilesize
8KB
-
memory/476-64-0x0000000077A10000-0x0000000077B90000-memory.dmpFilesize
1.5MB
-
memory/476-60-0x0000000000400000-0x00000000017F7000-memory.dmpFilesize
20.0MB
-
memory/476-57-0x0000000077A10000-0x0000000077B90000-memory.dmpFilesize
1.5MB
-
memory/476-58-0x0000000000400000-0x00000000017F7000-memory.dmpFilesize
20.0MB
-
memory/476-83-0x0000000000400000-0x00000000017F7000-memory.dmpFilesize
20.0MB
-
memory/476-54-0x0000000000400000-0x00000000017F7000-memory.dmpFilesize
20.0MB
-
memory/816-61-0x0000000000000000-mapping.dmp
-
memory/1040-82-0x0000000000000000-mapping.dmp
-
memory/1112-73-0x0000000000000000-mapping.dmp
-
memory/1160-67-0x0000000000000000-mapping.dmp
-
memory/1312-59-0x0000000000000000-mapping.dmp
-
memory/1368-63-0x0000000000000000-mapping.dmp
-
memory/1372-66-0x0000000000000000-mapping.dmp
-
memory/1508-69-0x0000000000000000-mapping.dmp
-
memory/1596-70-0x0000000000000000-mapping.dmp
-
memory/1612-79-0x000007FEFC0B1000-0x000007FEFC0B3000-memory.dmpFilesize
8KB
-
memory/1612-78-0x0000000000000000-mapping.dmp
-
memory/1704-81-0x0000000000000000-mapping.dmp
-
memory/1720-68-0x0000000000000000-mapping.dmp