ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da

Analysis

max time kernel
146s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
Size

273KB
MD5

0cce532e234e980666db7ac207677b99
SHA1

877550b13b48343d9fa2023243af998cf6554715
SHA256

ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da
SHA512

619316062c077c9bbcbb96742364f6fa7445a3027f7a05c75558a96e7d589199a7d4829a24fe90169d4bfccce51967d8f9e3d8c9e87e6a2f923cea4732a2556b
SSDEEP

6144:9MhiBs/ijJhu4Ab4CPfNjJjmQcYKxvpoyqMfz5Ak:9MhiBs/Ouh/x4LqMrn

Score

8^/10

evasion persistence trojan

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 3 IoCs

pid	Process
2040	LayerYahoo.exe
1972	LayerYahoo.exe
1628	MiniError.exe

Loads dropped DLL 2 IoCs

pid	Process
1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	reg.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MiniError.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files\MiniError.exe	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\StormII\stormSrv.exe	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\MiniError.exe	MiniError.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	LayerYahoo.exe
File created	C:\Program Files\StormII\stormSrv.exe	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	LayerYahoo.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	LayerYahoo.exe
File created	C:\Program Files\PersonalGoogle.bat	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\WinRGBDate.exe	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
File created	C:\Windows\EHEARC.txt	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
624	sc.exe
2044	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11cf-96B8-444553540000}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Enable AutoImageResize = "no"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "00000400"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Play_Animations = "no"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Videos = "no"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\SCRIPTHOSTENCODE	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\SCRIPTHOSTENCODE	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\SCRIPTHOSTENCODE	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\SCRIPTHOSTENCODE	regsvr32.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1476	reg.exe
1724	reg.exe
1736	reg.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
2040	LayerYahoo.exe
2040	LayerYahoo.exe
1972	LayerYahoo.exe
1972	LayerYahoo.exe
1628	MiniError.exe
1628	MiniError.exe
1628	MiniError.exe
1628	MiniError.exe
1628	MiniError.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2040	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	28
PID 1632 wrote to memory of 2040	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	28
PID 1632 wrote to memory of 2040	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	28
PID 1632 wrote to memory of 2040	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	28
PID 1632 wrote to memory of 1972	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	29
PID 1632 wrote to memory of 1972	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	29
PID 1632 wrote to memory of 1972	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	29
PID 1632 wrote to memory of 1972	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	29
PID 1632 wrote to memory of 276	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	30
PID 1632 wrote to memory of 276	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	30
PID 1632 wrote to memory of 276	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	30
PID 1632 wrote to memory of 276	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	30
PID 276 wrote to memory of 1168	276	cmd.exe	32
PID 276 wrote to memory of 1168	276	cmd.exe	32
PID 276 wrote to memory of 1168	276	cmd.exe	32
PID 276 wrote to memory of 1168	276	cmd.exe	32
PID 276 wrote to memory of 724	276	cmd.exe	33
PID 276 wrote to memory of 724	276	cmd.exe	33
PID 276 wrote to memory of 724	276	cmd.exe	33
PID 276 wrote to memory of 724	276	cmd.exe	33
PID 276 wrote to memory of 1528	276	cmd.exe	34
PID 276 wrote to memory of 1528	276	cmd.exe	34
PID 276 wrote to memory of 1528	276	cmd.exe	34
PID 276 wrote to memory of 1528	276	cmd.exe	34
PID 276 wrote to memory of 1528	276	cmd.exe	34
PID 276 wrote to memory of 1528	276	cmd.exe	34
PID 276 wrote to memory of 1528	276	cmd.exe	34
PID 1632 wrote to memory of 1628	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	35
PID 1632 wrote to memory of 1628	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	35
PID 1632 wrote to memory of 1628	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	35
PID 1632 wrote to memory of 1628	1632	ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe	35
PID 276 wrote to memory of 1760	276	cmd.exe	36
PID 276 wrote to memory of 1760	276	cmd.exe	36
PID 276 wrote to memory of 1760	276	cmd.exe	36
PID 276 wrote to memory of 1760	276	cmd.exe	36
PID 276 wrote to memory of 680	276	cmd.exe	37
PID 276 wrote to memory of 680	276	cmd.exe	37
PID 276 wrote to memory of 680	276	cmd.exe	37
PID 276 wrote to memory of 680	276	cmd.exe	37
PID 276 wrote to memory of 680	276	cmd.exe	37
PID 276 wrote to memory of 680	276	cmd.exe	37
PID 276 wrote to memory of 680	276	cmd.exe	37
PID 276 wrote to memory of 1476	276	cmd.exe	38
PID 276 wrote to memory of 1476	276	cmd.exe	38
PID 276 wrote to memory of 1476	276	cmd.exe	38
PID 276 wrote to memory of 1476	276	cmd.exe	38
PID 276 wrote to memory of 1792	276	cmd.exe	39
PID 276 wrote to memory of 1792	276	cmd.exe	39
PID 276 wrote to memory of 1792	276	cmd.exe	39
PID 276 wrote to memory of 1792	276	cmd.exe	39
PID 276 wrote to memory of 1916	276	cmd.exe	40
PID 276 wrote to memory of 1916	276	cmd.exe	40
PID 276 wrote to memory of 1916	276	cmd.exe	40
PID 276 wrote to memory of 1916	276	cmd.exe	40
PID 276 wrote to memory of 948	276	cmd.exe	41
PID 276 wrote to memory of 948	276	cmd.exe	41
PID 276 wrote to memory of 948	276	cmd.exe	41
PID 276 wrote to memory of 948	276	cmd.exe	41
PID 276 wrote to memory of 948	276	cmd.exe	41
PID 276 wrote to memory of 948	276	cmd.exe	41
PID 276 wrote to memory of 948	276	cmd.exe	41
PID 276 wrote to memory of 1508	276	cmd.exe	42
PID 276 wrote to memory of 1508	276	cmd.exe	42
PID 276 wrote to memory of 1508	276	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
"C:\Users\Admin\AppData\Local\Temp\ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\LayerYahoo.exe
  "C:\LayerYahoo.exe" C:\Users\Admin\AppData\Local\Temp\ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:2040
- C:\LayerYahoo.exe
  "C:\LayerYahoo.exe" rb
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\PersonalGoogle.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11cf-96B8-444553540000}" /v "Compatibility Flags" /t REG_SZ /d 00000400 /F
    3⤵
    - Modifies Internet Explorer settings
    PID:1168
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
    3⤵
    - Modifies Internet Explorer settings
    PID:724
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /u /s scrrun.dll
    3⤵
    - Modifies registry class
    PID:1528
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
    3⤵
    - Modifies Internet Explorer settings
    PID:1760
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /u /s itss.dll
    3⤵
    PID:680
- - C:\Windows\SysWOW64\reg.exe
    reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
    3⤵
    - Modifies registry key
    PID:1476
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
    3⤵
    - Modifies Internet Explorer settings
    PID:1792
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
    3⤵
    - Modifies Internet Explorer settings
    PID:1916
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /u /s vbscript.dll
    3⤵
    PID:948
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /u /s itss.dll
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
    3⤵
    - Modifies Internet Explorer settings
    PID:1512
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /u /s vbscript.dll
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
    3⤵
    - Modifies Internet Explorer settings
    PID:1160
- - C:\Windows\SysWOW64\reg.exe
    reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1724
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Enable AutoImageResize" /t REG_SZ /d no /F
    3⤵
    - Modifies Internet Explorer settings
    PID:1812
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /u /s shimgvw.dll
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\reg.exe
    reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
    3⤵
    - Modifies registry key
    PID:1736
- - C:\Windows\SysWOW64\sc.exe
    sc.exe create ccosmSrv BinPath= "C:\Program Files\StormII\stormSrv.exe /asservice" type= own type= interact start= auto DisplayName= PoliceError
    3⤵
    - Launches sc.exe
    PID:624
- - C:\Windows\SysWOW64\sc.exe
    sc.exe description ccosmSrv "Contrl Center of Storm Media"
    3⤵
    - Launches sc.exe
    PID:2044
- C:\Program Files\MiniError.exe
  "C:\Program Files\MiniError.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LayerYahoo.exe

Filesize
24KB

MD5
52d65eb8ff6c081627d4233c6ea089bd

SHA1
76c254ac29b19d6e98baa211ad9e5576c3828ba2

SHA256
6379279130e58dbfae8e2c8edd6b63d74908588835eb58484e693a693eb5c180

SHA512
2a668528ccccc5e408f9de0ab8887e8aba779b148bfa159a295d66a6565d1bbb5880c860fddf8aa823c7b999d6c04f9e1928aea61dce462d2f4207128bb5969d

Download Submit
C:\LayerYahoo.exe

Filesize
24KB

MD5
52d65eb8ff6c081627d4233c6ea089bd

SHA1
76c254ac29b19d6e98baa211ad9e5576c3828ba2

SHA256
6379279130e58dbfae8e2c8edd6b63d74908588835eb58484e693a693eb5c180

SHA512
2a668528ccccc5e408f9de0ab8887e8aba779b148bfa159a295d66a6565d1bbb5880c860fddf8aa823c7b999d6c04f9e1928aea61dce462d2f4207128bb5969d

Download Submit
C:\LayerYahoo.exe

Filesize
24KB

MD5
52d65eb8ff6c081627d4233c6ea089bd

SHA1
76c254ac29b19d6e98baa211ad9e5576c3828ba2

SHA256
6379279130e58dbfae8e2c8edd6b63d74908588835eb58484e693a693eb5c180

SHA512
2a668528ccccc5e408f9de0ab8887e8aba779b148bfa159a295d66a6565d1bbb5880c860fddf8aa823c7b999d6c04f9e1928aea61dce462d2f4207128bb5969d

Download Submit
C:\Program Files\MiniError.exe

Filesize
273KB

MD5
0cce532e234e980666db7ac207677b99

SHA1
877550b13b48343d9fa2023243af998cf6554715

SHA256
ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da

SHA512
619316062c077c9bbcbb96742364f6fa7445a3027f7a05c75558a96e7d589199a7d4829a24fe90169d4bfccce51967d8f9e3d8c9e87e6a2f923cea4732a2556b

Download Submit
C:\Program Files\MiniError.exe

Filesize
273KB

MD5
0cce532e234e980666db7ac207677b99

SHA1
877550b13b48343d9fa2023243af998cf6554715

SHA256
ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da

SHA512
619316062c077c9bbcbb96742364f6fa7445a3027f7a05c75558a96e7d589199a7d4829a24fe90169d4bfccce51967d8f9e3d8c9e87e6a2f923cea4732a2556b

Download Submit
C:\Program Files\PersonalGoogle.bat

Filesize
2KB

MD5
6088bef2dfbe0a88a399b120cc71ca9b

SHA1
dadf2f7a04b499e840e60af7648c7f00d8f7ac2c

SHA256
ec34fc17c535bfc868037f41a136e5546b010848a6ea095886b3df9a37173ffb

SHA512
aa3a2c73567a5f205d66be2b6792be49451e33de611e19d991a024c59c878326f10314eb5be27f6de5fd18e451d7523f16169a1e916c9a172ce81c132129d8ab

Download Submit
\Program Files\MiniError.exe

Filesize
273KB

MD5
0cce532e234e980666db7ac207677b99

SHA1
877550b13b48343d9fa2023243af998cf6554715

SHA256
ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da

SHA512
619316062c077c9bbcbb96742364f6fa7445a3027f7a05c75558a96e7d589199a7d4829a24fe90169d4bfccce51967d8f9e3d8c9e87e6a2f923cea4732a2556b

Download Submit
\Program Files\MiniError.exe

Filesize
273KB

MD5
0cce532e234e980666db7ac207677b99

SHA1
877550b13b48343d9fa2023243af998cf6554715

SHA256
ad107df79ff0f32a25ffaae6cb3561ad0becb6607e11dcd2a7c199a7fef153da

SHA512
619316062c077c9bbcbb96742364f6fa7445a3027f7a05c75558a96e7d589199a7d4829a24fe90169d4bfccce51967d8f9e3d8c9e87e6a2f923cea4732a2556b

Download Submit
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads