3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe
Size

64KB
MD5

deddae20f521af57b793b3cbec0cd3a0
SHA1

5c46f84661e59524d4a25ce3ecb24e9e70f887f9
SHA256

3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1
SHA512

73a4b02f76dd266f74c190c5fe31402e5a867ee2769c306b2a7f8902436e98523648cd3f80a5850e5b88689e326342185675dbe56cb46db5e2feaf329d469e4f
SSDEEP

384:WfvwV69xlL2ZD0Pba3FA+vkyn3Sz7ki2PGlSNrk6u2c6qGzf:O4g4ZdFtvfn3SHki2GljZf6qQ

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\C:\Windows\fonts\hjmcnlpd.dll = "{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}"	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe

Deletes itself 1 IoCs

pid	Process
1224	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe
2000	regsvr32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\fonts\hjmcnlpd.tmp	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe
File opened for modification	C:\Windows\fonts\gzqqxx01.dat	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl\CLSID\ = "{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\InprocServer32\ = "C:\\Windows\\fonts\\hjmcnlpd.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0\HELPDIR\ = "C:\\Windows\\fonts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0\ = "QQXX 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\TypeLib\ = "{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl.1\ = "qqxxatl Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\ = "qqxxatl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl\CurVer\ = "QQXX.qqxxatl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\TypeLib\ = "{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl.1\CLSID\ = "{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQXX.qqxxatl\ = "qqxxatl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0\0\win32\ = "C:\\Windows\\fonts\\hjmcnlpd.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\ = "Iqqxxatl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\ = "Iqqxxatl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\TypeLib\ = "{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\VersionIndependentProgID\ = "QQXX.qqxxatl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{334E586E-C2FF-44DB-953D-1C6B988C638F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBB7ADFA-C76C-4BD4-864D-F438D2DDCE80}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58B05EE-6CA5-42E1-A0CE-82169DDEE42C}\ProgID\ = "QQXX.qqxxatl.1"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe
1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe
1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2000	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	28
PID 1896 wrote to memory of 2000	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	28
PID 1896 wrote to memory of 2000	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	28
PID 1896 wrote to memory of 2000	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	28
PID 1896 wrote to memory of 2000	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	28
PID 1896 wrote to memory of 2000	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	28
PID 1896 wrote to memory of 2000	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	28
PID 1896 wrote to memory of 1224	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	29
PID 1896 wrote to memory of 1224	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	29
PID 1896 wrote to memory of 1224	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	29
PID 1896 wrote to memory of 1224	1896	3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe	29

C:\Users\Admin\AppData\Local\Temp\3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe
"C:\Users\Admin\AppData\Local\Temp\3332f27ec0c41f89c703df060b9daa88ccbd37c32c008d422c3657881dd3ccb1.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Windows\fonts\hjmcnlpd.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\3332F2~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\fonts\hjmcnlpd.dll

Filesize
44KB

MD5
40758e257cba2ec1e8d67c5dc986642b

SHA1
f85ff215551d73009ffd2cceb6b9a12dcdf41975

SHA256
f654be37402c81a0f4b0442a0e71c7b6b5d37d0ea13132695dc054eac0fb0638

SHA512
0c540d9f4073596e6959cd6957041d12c6543e9589c080f7e075999bb15f7feccae22bc8faec4ef0fd4a6eced198ec987e26b6cafc5258c47bea0782514b6996

Download Submit
\Windows\Fonts\hjmcnlpd.dll

Filesize
44KB

MD5
40758e257cba2ec1e8d67c5dc986642b

SHA1
f85ff215551d73009ffd2cceb6b9a12dcdf41975

SHA256
f654be37402c81a0f4b0442a0e71c7b6b5d37d0ea13132695dc054eac0fb0638

SHA512
0c540d9f4073596e6959cd6957041d12c6543e9589c080f7e075999bb15f7feccae22bc8faec4ef0fd4a6eced198ec987e26b6cafc5258c47bea0782514b6996

Download Submit
\Windows\Fonts\hjmcnlpd.dll

Filesize
44KB

MD5
40758e257cba2ec1e8d67c5dc986642b

SHA1
f85ff215551d73009ffd2cceb6b9a12dcdf41975

SHA256
f654be37402c81a0f4b0442a0e71c7b6b5d37d0ea13132695dc054eac0fb0638

SHA512
0c540d9f4073596e6959cd6957041d12c6543e9589c080f7e075999bb15f7feccae22bc8faec4ef0fd4a6eced198ec987e26b6cafc5258c47bea0782514b6996

Download Submit
memory/2000-56-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download