Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 21:57
Static task
static1
Behavioral task
behavioral1
Sample
cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe
-
Size
459KB
-
MD5
c8cb0aa0c433c38c5c194dde5464cb8e
-
SHA1
0a4a9c08b62e16bd9ebd104f9b198074d894261c
-
SHA256
cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7
-
SHA512
9c75e87f7c808ddacb0090db17662ec5fb1cecf2be8af815f9ad0ffc07492fc9a9a3815f08b82959063891320d8874df7b9c644dbd468b31f8070236faa5213e
-
SSDEEP
12288:hmw8rpi2jNpgiVwGd3RwnDowSbmoq4YrNw7Ef7qs9HGEXEx2ft7fTneSvG7tvH3s:Ui2jNp3Vw8RwnDowSbmoq42Nw7W739Hp
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe scvhost.exe" scvhost.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe -
Executes dropped EXE 1 IoCs
pid Process 3468 scvhost.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE9B0434-D9C0-A119-D100-B08000CA6000}\StubPath = "C:\\Windows\\scvhost.exe" scvhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE9B0434-D9C0-A119-D100-B08000CA6000} cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE9B0434-D9C0-A119-D100-B08000CA6000}\StubPath = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE9B0434-D9C0-A119-D100-B08000CA6000} scvhost.exe -
Loads dropped DLL 2 IoCs
pid Process 3836 regsvr32.exe 3468 scvhost.exe -
Adds Run key to start application 2 TTPs 56 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\icq lite = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\AntiVir = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msconfig = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\icq lite = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\Update Checker = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\ = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\ = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\Update Checker = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Update Checker = "C:\\Windows\\scvhost.exe" scvhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\ = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\icq lite = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\msconfig = "C:\\Windows\\scvhost.exe" scvhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\icq lite = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\msconfig = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\AntiVir = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\AntiVir = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\AntiVir = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Update Checker = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\Update Checker = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\Windows Update = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AntiVir = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\icq lite = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Update Checker = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\msconfig = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icq lite = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\Windows Update = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msconfig = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\ = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Update Checker = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\AntiVir = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AntiVir = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\msconfig = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icq lite = "C:\\Windows\\scvhost.exe" scvhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUN cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\Windows Update = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\msconfig = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\AntiVir = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\Update Checker = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUN scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\Windows Update = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Windows Update = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\msconfig = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\icq lite = "C:\\Windows\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Windows Update = "C:\\Windows\\scvhost.exe" cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\scvhost.exe cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe File opened for modification C:\Windows\ cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe File created C:\Windows\scvhost.exe cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe File opened for modification C:\Windows\mswinsck.ocx cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe File opened for modification C:\Windows\scvhost.exe scvhost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\mswinsck.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\mswinsck.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\mswinsck.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\mswinsck.ocx, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3468 scvhost.exe 3468 scvhost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3060 cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe 3468 scvhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3060 wrote to memory of 3836 3060 cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe 78 PID 3060 wrote to memory of 3836 3060 cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe 78 PID 3060 wrote to memory of 3836 3060 cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe 78 PID 3060 wrote to memory of 3468 3060 cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe 79 PID 3060 wrote to memory of 3468 3060 cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe 79 PID 3060 wrote to memory of 3468 3060 cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe"C:\Users\Admin\AppData\Local\Temp\cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\mswinsck.ocx"2⤵
- Loads dropped DLL
- Modifies registry class
PID:3836
-
-
C:\Windows\scvhost.exeC:\Windows\scvhost.exe C:\Users\Admin\AppData\Local\Temp\cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3468
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
459KB
MD5c8cb0aa0c433c38c5c194dde5464cb8e
SHA10a4a9c08b62e16bd9ebd104f9b198074d894261c
SHA256cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7
SHA5129c75e87f7c808ddacb0090db17662ec5fb1cecf2be8af815f9ad0ffc07492fc9a9a3815f08b82959063891320d8874df7b9c644dbd468b31f8070236faa5213e
-
Filesize
459KB
MD5c8cb0aa0c433c38c5c194dde5464cb8e
SHA10a4a9c08b62e16bd9ebd104f9b198074d894261c
SHA256cd746d53cfce27a32af8071feddef301b510e2229eaa5466bb8ef6c8d054b7a7
SHA5129c75e87f7c808ddacb0090db17662ec5fb1cecf2be8af815f9ad0ffc07492fc9a9a3815f08b82959063891320d8874df7b9c644dbd468b31f8070236faa5213e