6f47c3f41fcd0dde186bef174574b8473bae81cd050d88f2953e5814c0f12a12

General

Target

rob_setup.exe
Size

3.8MB
MD5

15d7d8d30cff7298b426aee77c8921d1
SHA1

f3139a950ae1e030d77af3ae037ea2107aa5f58f
SHA256

6f47c3f41fcd0dde186bef174574b8473bae81cd050d88f2953e5814c0f12a12
SHA512

f74d01ef35dc0f703d43e0fbac1deb1a42ce0825de81c69919a6f7107592a94c96bb0d7a62809afc60f7c19b2dd818c4f2909a66d508a18de030e235ac148358
SSDEEP

98304:gEtaHbvRayraF3q3YALB3Br4IWBS3xi1Yo8C4Esg3:6LhI63Bcqhi1R8ztU

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

rob_setup.tmprob_launcher.exe

pid process

884 rob_setup.tmp
1484 rob_launcher.exe
Loads dropped DLL 1 IoCs

Processes:

rob_setup.exe

pid process

752 rob_setup.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
752	rob_setup.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046f6549d1addc3419c73b77e7a20b9d600000000020000000000106600000001000020000000440c7ed7a9d099e18ef6f22dafa08881380fadbb5b89b4ca572a8c2c6a3dbdf7000000000e8000000002000020000000d9cc8491d0ee504b668f86ea24524c65c32dd7cb46f4487a000ec34a8a849e5520000000a52c1cbec4cd263ad01d7b0846efe6c07ec0393d7dcc318aac9635d89973ac66400000001215680979d68ae3be48496620cc1ccf655cbf8c11ac61fcf393ed91ffc238f88a562e02fe7db58b9ca5c3606da5eab8d01589aac93e0ab8a7e6619152317299	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE2E7711-9CA0-11ED-A6E1-52E8C5FCC7C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8016e593ad30d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046f6549d1addc3419c73b77e7a20b9d60000000002000000000010660000000100002000000081fd7cbf06647e106f29460dd74041dc3382dfd477d9dcd30a1b7c6754bea5c7000000000e8000000002000020000000e87435bb9e261c31229d12eddad703da3817f0bacf0037fbcd1c738deab66cfa90000000b3e027bf85e9cd192a23c06cc8d6ba60d129ac490824fa01882d6f803d5f8610158c638e29a845c84dd7a8294717d6f4985811e9d4ab1fe982726a07423f6f8eace2ddb5bcd069720cff284687284b756cf5e62c6873d75300ec4148d11a991dbc3c3165b86cc44f34ed13d2c652c83b39dade8bba91f463cfac8145a312dfa0593050515fdda0d23eecd390d76a4344400000007d2fb4f4d1707906baed338782145e6fc71c5448b622155c163dc97a98b0a0cd3118bf63ec8b7e0b047afbdeed82d9d01ae4d55b825f52405d9839ce77d05627	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies registry class 6 IoCs

Processes:

rob_setup.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rob-launcher	rob_setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rob-launcher\URL Protocol	rob_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rob-launcher\shell	rob_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rob-launcher\shell\open	rob_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rob-launcher\shell\open\command	rob_setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rob-launcher\shell\open\command\ = "C:\\Gravity\\RagnarokBegins(WEST)\\rob_launcher.exe %1"	rob_setup.tmp

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

rob_launcher.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	rob_launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rob_launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rob_launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rob_launcher.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2020 vlc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rob_setup.tmp

pid process

884 rob_setup.tmp
884 rob_setup.tmp
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

2020 vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1564	AUDIODG.EXE
Token: 33	1564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1564	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

rob_setup.tmpvlc.exeiexplore.exe

pid	process
884	rob_setup.tmp
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
988	iexplore.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

vlc.exe

pid	process
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe
2020	vlc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

vlc.exeiexplore.exeIEXPLORE.EXE

pid process

2020 vlc.exe
988 iexplore.exe
988 iexplore.exe
1664 IEXPLORE.EXE
1664 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rob_setup.exewmplayer.exeiexplore.exe

description	pid	process	target process
PID 752 wrote to memory of 884	752	rob_setup.exe	rob_setup.tmp
PID 752 wrote to memory of 884	752	rob_setup.exe	rob_setup.tmp
PID 752 wrote to memory of 884	752	rob_setup.exe	rob_setup.tmp
PID 752 wrote to memory of 884	752	rob_setup.exe	rob_setup.tmp
PID 752 wrote to memory of 884	752	rob_setup.exe	rob_setup.tmp
PID 752 wrote to memory of 884	752	rob_setup.exe	rob_setup.tmp
PID 752 wrote to memory of 884	752	rob_setup.exe	rob_setup.tmp
PID 1528 wrote to memory of 1948	1528	wmplayer.exe	setup_wm.exe
PID 1528 wrote to memory of 1948	1528	wmplayer.exe	setup_wm.exe
PID 1528 wrote to memory of 1948	1528	wmplayer.exe	setup_wm.exe
PID 1528 wrote to memory of 1948	1528	wmplayer.exe	setup_wm.exe
PID 1528 wrote to memory of 1948	1528	wmplayer.exe	setup_wm.exe
PID 1528 wrote to memory of 1948	1528	wmplayer.exe	setup_wm.exe
PID 1528 wrote to memory of 1948	1528	wmplayer.exe	setup_wm.exe
PID 988 wrote to memory of 1664	988	iexplore.exe	IEXPLORE.EXE
PID 988 wrote to memory of 1664	988	iexplore.exe	IEXPLORE.EXE
PID 988 wrote to memory of 1664	988	iexplore.exe	IEXPLORE.EXE
PID 988 wrote to memory of 1664	988	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\rob_setup.exe
"C:\Users\Admin\AppData\Local\Temp\rob_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\is-2LU90.tmp\rob_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2LU90.tmp\rob_setup.tmp" /SL5="$60124,2575279,780800,C:\Users\Admin\AppData\Local\Temp\rob_setup.exe"
2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:884

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnlockImport.WTV"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2020

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
2⤵
PID:1948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\CompleteGet.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:988 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Gravity\RagnarokBegins(WEST)\rob_launcher.exe
"C:\Gravity\RagnarokBegins(WEST)\rob_launcher.exe"
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1484

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Gravity\RagnarokBegins(WEST)\rob_launcher.exe
Filesize
2.9MB

MD5
43a74f54478d8711986cf220b6f101fa

SHA1
f37e2d22e49ed103655a5c357b54aabbc556d91a

SHA256
a8e7c6cbd305bd2bb8ec4bdfb33789672ef839f0da2266ee309e77309201249d

SHA512
fce3f485485d975a488e1308a70df25ca370d6a965dbfa7d70a0f8eb773f6bcc056a95542b33ce08826b186dd406aa6fb6962a3c8ffbdb063cdf312f788170dd

Download Submit
C:\Gravity\RagnarokBegins(WEST)\rob_launcher.exe
Filesize
2.9MB

MD5
43a74f54478d8711986cf220b6f101fa

SHA1
f37e2d22e49ed103655a5c357b54aabbc556d91a

SHA256
a8e7c6cbd305bd2bb8ec4bdfb33789672ef839f0da2266ee309e77309201249d

SHA512
fce3f485485d975a488e1308a70df25ca370d6a965dbfa7d70a0f8eb773f6bcc056a95542b33ce08826b186dd406aa6fb6962a3c8ffbdb063cdf312f788170dd

Download Submit
C:\Gravity\RagnarokBegins(WEST)\rob_launcher_data.lst
Filesize
107B

MD5
c50ff07b9a10fbb5ab489752fcf8030d

SHA1
2962b0e0f9ec4e71537af40dc134295ac4a19841

SHA256
bcdde5324d011a0388c2a9e7baaf39d8f0aa03b7092809bf0e810f5bcbbe869d

SHA512
7c4c103bb0db5e3311745f909a54fd16e638be667f56710f1241ed36b82a24a0b5a04519f5c0f16855edf389f653b64ee9bca99246ac90a4f0d40aae4a6f639f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2LU90.tmp\rob_setup.tmp
Filesize
2.5MB

MD5
5fd78f8456484021806be6944cca3bd8

SHA1
ca205a25192195c72762b5af4379d96b71cfb004

SHA256
41516d754bcc18ef5659d9c69abba163a637d52f25e4ddc69548283826a95e96

SHA512
24328c63cecf0fa1fc121e3ec2cc696161b4cb04862de88f4554181707f1c92cfa56854021c4583abd9e26fc1848f0ae9c0222add77bd55ed9bcd884dc8d71d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2LU90.tmp\rob_setup.tmp
Filesize
2.5MB

MD5
5fd78f8456484021806be6944cca3bd8

SHA1
ca205a25192195c72762b5af4379d96b71cfb004

SHA256
41516d754bcc18ef5659d9c69abba163a637d52f25e4ddc69548283826a95e96

SHA512
24328c63cecf0fa1fc121e3ec2cc696161b4cb04862de88f4554181707f1c92cfa56854021c4583abd9e26fc1848f0ae9c0222add77bd55ed9bcd884dc8d71d1

Download Submit
\Users\Admin\AppData\Local\Temp\is-2LU90.tmp\rob_setup.tmp
Filesize
2.5MB

MD5
5fd78f8456484021806be6944cca3bd8

SHA1
ca205a25192195c72762b5af4379d96b71cfb004

SHA256
41516d754bcc18ef5659d9c69abba163a637d52f25e4ddc69548283826a95e96

SHA512
24328c63cecf0fa1fc121e3ec2cc696161b4cb04862de88f4554181707f1c92cfa56854021c4583abd9e26fc1848f0ae9c0222add77bd55ed9bcd884dc8d71d1

Download Submit
memory/752-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/752-61-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/752-64-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/752-55-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/884-62-0x0000000074D01000-0x0000000074D03000-memory.dmp

Filesize
8KB

Download
memory/884-58-0x0000000000000000-mapping.dmp

Download
memory/1484-71-0x000007FEECCF0000-0x000007FEED713000-memory.dmp

Filesize
10.1MB

Download
memory/1484-72-0x000007FEEBA10000-0x000007FEECAA6000-memory.dmp

Filesize
16.6MB

Download
memory/1948-67-0x0000000000000000-mapping.dmp

Download
memory/2020-65-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads