Behavioral Report

Analysis

max time kernel
138s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 10:44

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

setup_pstmafm44x_20220402_Beta.exe
Size

28MB
MD5

153d9212e049fa053d2337de207f169f
SHA1

8c8b0692d48c3bc8ede9f426993f283943c79537
SHA256

2e5f727b95527d3320a50400c48bec4208dd10f39776e667fccfc943287f27ff
SHA512

daa6a6e39824ded9cbc716ac2aa734c7be124fbfb1156ed03818b9d7891d7cbf7685c73f82cdf82f0812ae9f64d0f1da89523dc5060f589da04b06ef8230d6a0
SSDEEP

786432:iliap7IQWxhhh+3vLccvBG7yadtUlkiYno6RgzQCTyr0satP8:iliaBEhhh+3vNvBGyeGk5o6i0Ayr0sY0

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Executes dropped EXE ⋅ 4 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.tmpPstmafm.exePstmafm.exeSTMAFMDSPforWindows.exe

pid process

1232 setup_pstmafm44x_20220402_Beta.tmp
1544 Pstmafm.exe
568 Pstmafm.exe
1324 STMAFMDSPforWindows.exe

Registers COM server for autorun ⋅ 1 TTPs 4 IoCs

persistence

TTPs:

Registry Run Keys / Startup Folder

Processes:

Pstmafm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\LocalServer32\ = "C:\\CreaTec\\STMAFM20220402\\Pstmafm.exe"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\LocalServer32	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\LocalServer32\ = "C:\\CreaTec\\STMAFM20220402\\Pstmafm.exe"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\LocalServer32	Pstmafm.exe

Loads dropped DLL ⋅ 6 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.exesetup_pstmafm44x_20220402_Beta.tmpPstmafm.exe

pid	process
1652	setup_pstmafm44x_20220402_Beta.exe
1232	setup_pstmafm44x_20220402_Beta.tmp
1232	setup_pstmafm44x_20220402_Beta.tmp
568	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe

Checks installed software on the system ⋅ 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

TTPs:

Query Registry
Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
evasion trojan

TTPs:

System Information Discovery

Processes:

Pstmafm.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Pstmafm.exe
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Pstmafm.exe

Checks processor information in registry ⋅ 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

Pstmafm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Pstmafm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Pstmafm.exe

Modifies registry class ⋅ 64 IoCs

Processes:

Pstmafm.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\0\win32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmrem\Clsid	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\ = "IstmafmeventEvents"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\ProgID\ = "Pstmafm.stmafmevent"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\ = "stmafmevent Object"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\ProgID	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\LocalServer32\ = "C:\\CreaTec\\STMAFM20220402\\Pstmafm.exe"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\0	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ = "Istmafmevent"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\ProxyStubClsid32	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib\Version = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\LocalServer32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmevent\Clsid	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmevent\Clsid\ = "{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\ProgID	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\TypeLib\ = "{FDCF968A-9B44-4A8E-9374-CC747900FCBD}"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\TypeLib\Version = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmevent\ = "stmafmevent Object"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\FLAGS\ = "0"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib\Version = "1.0"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\TypeLib\ = "{FDCF968A-9B44-4A8E-9374-CC747900FCBD}"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\TypeLib	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\ = "Istmafmuser"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\ = "Pstmafm Library"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\ProxyStubClsid32	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\TypeLib\Version = "1.0"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\TypeLib\ = "{FDCF968A-9B44-4A8E-9374-CC747900FCBD}"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\TypeLib	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\TypeLib	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\ = "stmafmrem Object"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib\ = "{FDCF968A-9B44-4A8E-9374-CC747900FCBD}"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\LocalServer32\ = "C:\\CreaTec\\STMAFM20220402\\Pstmafm.exe"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmrem\ = "stmafmrem Object"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\TypeLib\Version = "1.0"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\TypeLib\Version = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\ProxyStubClsid32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\ProgID\ = "Pstmafm.stmafmrem"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\HELPDIR	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\ = "Istmafmrem"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ProxyStubClsid32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ProxyStubClsid32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\ = "Istmafmuser"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\Version\ = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\ = "Istmafmrem"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\TypeLib\Version = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\Version	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\TypeLib	Pstmafm.exe

Suspicious behavior: EnumeratesProcesses ⋅ 7 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.tmpPstmafm.exePstmafm.exe

pid	process
1232	setup_pstmafm44x_20220402_Beta.tmp
1232	setup_pstmafm44x_20220402_Beta.tmp
1544	Pstmafm.exe
1544	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe

Suspicious use of FindShellTrayWindow ⋅ 1 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.tmp

pid process

1232 setup_pstmafm44x_20220402_Beta.tmp
Suspicious use of SetWindowsHookEx ⋅ 5 IoCs

Processes:

Pstmafm.exePstmafm.exe

pid process

1544 Pstmafm.exe
568 Pstmafm.exe
568 Pstmafm.exe
568 Pstmafm.exe
568 Pstmafm.exe

pid	process
1544	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe

Suspicious use of WriteProcessMemory ⋅ 19 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.exesetup_pstmafm44x_20220402_Beta.tmpPstmafm.exe

description	pid	process	target process
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1232 wrote to memory of 1544	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 1544	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 1544	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 1544	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 568	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 568	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 568	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 568	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 568 wrote to memory of 1324	568	Pstmafm.exe	STMAFMDSPforWindows.exe
PID 568 wrote to memory of 1324	568	Pstmafm.exe	STMAFMDSPforWindows.exe
PID 568 wrote to memory of 1324	568	Pstmafm.exe	STMAFMDSPforWindows.exe
PID 568 wrote to memory of 1324	568	Pstmafm.exe	STMAFMDSPforWindows.exe

C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe

"C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe"

Loads dropped DLL
Suspicious use of WriteProcessMemory

PID:1652

C:\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp

"C:\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp" /SL5="$70124,29710762,721408,C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe"

Executes dropped EXE
Loads dropped DLL
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory

PID:1232

C:\CreaTec\STMAFM20220402\Pstmafm.exe

"C:\CreaTec\STMAFM20220402\Pstmafm.exe" /regserverperuser

Executes dropped EXE
Registers COM server for autorun
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx

PID:1544

C:\CreaTec\STMAFM20220402\Pstmafm.exe

"C:\CreaTec\STMAFM20220402\Pstmafm.exe"

Executes dropped EXE
Loads dropped DLL
Checks whether UAC is enabled
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory

PID:568

C:\CreaTec\STMAFM20220402\STMAFMDSPforWindows.exe

"C:\CreaTec\STMAFM20220402\STMAFMDSPforWindows.exe" 51599

Executes dropped EXE

PID:1324

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
C:\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
C:\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
C:\CreaTec\STMAFM20220402\STMAFMDSPforWindows.exe
Filesize
192KB

MD5
c61d77e8f0d3a97d4f7f7422d6b3a9e6

SHA1
e8600b6c645b4430dcaa801cd3c9c705930e8989

SHA256
1bdca23795e20381421a61a2faf4ea8c7f482c77c00d8f13fd54ad5959dba2d9

SHA512
2b709bcdcfeb9dfa7705b128217ccba194cdb40ad0b37c3cecbdc323542235d3347252ee6e599b4e85561a001bd7c23168663a4f42b72b6368c316e99fd05136

Download Submit
C:\CreaTec\STMAFM20220402\stmafmdspforwindows.exe
Filesize
192KB

MD5
c61d77e8f0d3a97d4f7f7422d6b3a9e6

SHA1
e8600b6c645b4430dcaa801cd3c9c705930e8989

SHA256
1bdca23795e20381421a61a2faf4ea8c7f482c77c00d8f13fd54ad5959dba2d9

SHA512
2b709bcdcfeb9dfa7705b128217ccba194cdb40ad0b37c3cecbdc323542235d3347252ee6e599b4e85561a001bd7c23168663a4f42b72b6368c316e99fd05136

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp
Filesize
2MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp
Filesize
2MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
\CreaTec\STMAFM20220402\stmafmdspforwindows.exe
Filesize
192KB

MD5
c61d77e8f0d3a97d4f7f7422d6b3a9e6

SHA1
e8600b6c645b4430dcaa801cd3c9c705930e8989

SHA256
1bdca23795e20381421a61a2faf4ea8c7f482c77c00d8f13fd54ad5959dba2d9

SHA512
2b709bcdcfeb9dfa7705b128217ccba194cdb40ad0b37c3cecbdc323542235d3347252ee6e599b4e85561a001bd7c23168663a4f42b72b6368c316e99fd05136

Download Submit
\CreaTec\STMAFM20220402\stmafmdspforwindows.exe
Filesize
192KB

MD5
c61d77e8f0d3a97d4f7f7422d6b3a9e6

SHA1
e8600b6c645b4430dcaa801cd3c9c705930e8989

SHA256
1bdca23795e20381421a61a2faf4ea8c7f482c77c00d8f13fd54ad5959dba2d9

SHA512
2b709bcdcfeb9dfa7705b128217ccba194cdb40ad0b37c3cecbdc323542235d3347252ee6e599b4e85561a001bd7c23168663a4f42b72b6368c316e99fd05136

Download Submit
\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp
Filesize
2MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
memory/568-70-0x0000000000000000-mapping.dmp

Download
memory/1232-62-0x0000000074421000-0x0000000074423000-memory.dmp

Filesize
8KB

Download
memory/1232-58-0x0000000000000000-mapping.dmp

Download
memory/1324-78-0x0000000000000000-mapping.dmp

Download
memory/1544-65-0x0000000000000000-mapping.dmp

Download
memory/1652-61-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1652-73-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1652-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download