22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8

General

Target

22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe
Size

261KB
MD5

3bb35ccb6bd85fee083abc2c3f67a306
SHA1

cf441832bf08474040a687e86807d2c966cf56c6
SHA256

22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8
SHA512

d864daac805a2ea631c77bac45bbaf7bd08d1a9565e99c426f6f15f444489cd01331d0f127807f7977f6f4dba0cf0a71b57b596109ca9836b216b7d4bca9a2db
SSDEEP

6144:d9wAfXp+1RrZmnq4eiiRtYhjgBlIbqDzt:/wj8DjyYhjgvIWnt

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

notepad.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctdimlhze.exe	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctdimlhze.exe\DisableExceptionChainValidation	notepad.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

Processes:

notepad.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	notepad.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\ProgramData\yauhsgjabvdbja\desktop.ini notepad.exe

description	ioc	process
File created	C:\ProgramData\yauhsgjabvdbja\desktop.ini	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe

description	pid	process	target process
PID 1728 set thread context of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

notepad.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	notepad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	notepad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	notepad.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

428 schtasks.exe

pid	process
428	schtasks.exe

Modifies registry class 7 IoCs

Processes:

notepad.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{0E2CD8A6-0F84-5A43-93B0-6A13F738F2B2}\665407E0\ê'Yu3\BID = 200008001d000b00e6070000140000001d0016002b002b00000000001f8b8663	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{0E2CD8A6-0F84-5A43-93B0-6A13F738F2B2}\665407E0\CG1	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{0E2CD8A6-0F84-5A43-93B0-6A13F738F2B2}	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{0E2CD8A6-0F84-5A43-93B0-6A13F738F2B2}\665407E0	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{0E2CD8A6-0F84-5A43-93B0-6A13F738F2B2}\665407E0\CG1\HAL = 05ee0000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{0E2CD8A6-0F84-5A43-93B0-6A13F738F2B2}\665407E0\ê'Yu3	notepad.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

notepad.exe

pid process

1572 notepad.exe
1572 notepad.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

notepad.exe

description pid process

Token: SeRestorePrivilege 1572 notepad.exe
Token: SeBackupPrivilege 1572 notepad.exe
Token: SeDebugPrivilege 1572 notepad.exe

pid	process
1572	notepad.exe
1572	notepad.exe

description	pid	process
Token: SeRestorePrivilege	1572	notepad.exe
Token: SeBackupPrivilege	1572	notepad.exe
Token: SeDebugPrivilege	1572	notepad.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exenotepad.exe

description	pid	process	target process
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1728 wrote to memory of 1572	1728	22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe	notepad.exe
PID 1572 wrote to memory of 428	1572	notepad.exe	schtasks.exe
PID 1572 wrote to memory of 428	1572	notepad.exe	schtasks.exe
PID 1572 wrote to memory of 428	1572	notepad.exe	schtasks.exe
PID 1572 wrote to memory of 428	1572	notepad.exe	schtasks.exe
PID 1572 wrote to memory of 1840	1572	notepad.exe	WerFault.exe
PID 1572 wrote to memory of 1840	1572	notepad.exe	WerFault.exe
PID 1572 wrote to memory of 1840	1572	notepad.exe	WerFault.exe
PID 1572 wrote to memory of 1840	1572	notepad.exe	WerFault.exe
PID 1572 wrote to memory of 1840	1572	notepad.exe	WerFault.exe
PID 1572 wrote to memory of 1840	1572	notepad.exe	WerFault.exe
PID 1572 wrote to memory of 1840	1572	notepad.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe
"C:\Users\Admin\AppData\Local\Temp\22170077277aa8d7f3fe0e30bcb187cfa7dcda0d018d6cabf1bde17d24fadda8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
2⤵
- Sets file execution options in registry
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x665407E0" /TR "C:\ProgramData\yauhsgjabvdbja\ctdimlhze.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:428

C:\Windows\SysWOW64\WerFault.exe
"C:\Windows\SysWOW64\WerFault.exe"
3⤵
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Security Software Discovery

1

T1063

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-74-0x0000000000000000-mapping.dmp

Download
memory/1572-73-0x0000000000180000-0x00000000001CB000-memory.dmp

Filesize
300KB

Download
memory/1572-59-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1572-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1572-71-0x0000000000180000-0x00000000001CB000-memory.dmp

Filesize
300KB

Download
memory/1572-70-0x0000000000180000-0x00000000001CB000-memory.dmp

Filesize
300KB

Download
memory/1572-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1572-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1572-63-0x000000000040120A-mapping.dmp

Download
memory/1572-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1572-72-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/1572-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1572-56-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1572-58-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1728-65-0x0000000074F00000-0x00000000754AB000-memory.dmp

Filesize
5.7MB

Download
memory/1728-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1728-55-0x0000000074F00000-0x00000000754AB000-memory.dmp

Filesize
5.7MB

Download
memory/1840-75-0x0000000000000000-mapping.dmp

Download
memory/1840-76-0x0000000000190000-0x000000000020A000-memory.dmp

Filesize
488KB

Download
memory/1840-77-0x0000000077D40000-0x0000000077EC1000-memory.dmp

Filesize
1.5MB

Download
memory/1840-78-0x0000000000190000-0x000000000020A000-memory.dmp

Filesize
488KB

Download
memory/1840-79-0x0000000077D40000-0x0000000077EC1000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads