2e5f727b95527d3320a50400c48bec4208dd10f39776e667fccfc943287f27ff

Analysis

max time kernel
138s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_pstmafm44x_20220402_Beta.exe
Size

29.0MB
MD5

153d9212e049fa053d2337de207f169f
SHA1

8c8b0692d48c3bc8ede9f426993f283943c79537
SHA256

2e5f727b95527d3320a50400c48bec4208dd10f39776e667fccfc943287f27ff
SHA512

daa6a6e39824ded9cbc716ac2aa734c7be124fbfb1156ed03818b9d7891d7cbf7685c73f82cdf82f0812ae9f64d0f1da89523dc5060f589da04b06ef8230d6a0
SSDEEP

786432:iliap7IQWxhhh+3vLccvBG7yadtUlkiYno6RgzQCTyr0satP8:iliaBEhhh+3vNvBGyeGk5o6i0Ayr0sY0

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.tmpPstmafm.exePstmafm.exeSTMAFMDSPforWindows.exe

pid process

1232 setup_pstmafm44x_20220402_Beta.tmp
1544 Pstmafm.exe
568 Pstmafm.exe
1324 STMAFMDSPforWindows.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

Pstmafm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\LocalServer32\ = "C:\\CreaTec\\STMAFM20220402\\Pstmafm.exe"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\LocalServer32	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\LocalServer32\ = "C:\\CreaTec\\STMAFM20220402\\Pstmafm.exe"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\LocalServer32	Pstmafm.exe

Loads dropped DLL 6 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.exesetup_pstmafm44x_20220402_Beta.tmpPstmafm.exe

pid	process
1652	setup_pstmafm44x_20220402_Beta.exe
1232	setup_pstmafm44x_20220402_Beta.tmp
1232	setup_pstmafm44x_20220402_Beta.tmp
568	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Pstmafm.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Pstmafm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Pstmafm.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Pstmafm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Pstmafm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Pstmafm.exe

Modifies registry class 64 IoCs

Processes:

Pstmafm.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\0\win32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmrem\Clsid	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\ = "IstmafmeventEvents"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\ProgID\ = "Pstmafm.stmafmevent"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\ = "stmafmevent Object"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\ProgID	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\LocalServer32\ = "C:\\CreaTec\\STMAFM20220402\\Pstmafm.exe"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\0	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ = "Istmafmevent"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\ProxyStubClsid32	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib\Version = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\LocalServer32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmevent\Clsid	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmevent\Clsid\ = "{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\ProgID	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\TypeLib\ = "{FDCF968A-9B44-4A8E-9374-CC747900FCBD}"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\TypeLib\Version = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmevent\ = "stmafmevent Object"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\FLAGS\ = "0"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib\Version = "1.0"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\TypeLib\ = "{FDCF968A-9B44-4A8E-9374-CC747900FCBD}"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\TypeLib	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\ = "Istmafmuser"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\ = "Pstmafm Library"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\ProxyStubClsid32	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\TypeLib\Version = "1.0"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\TypeLib\ = "{FDCF968A-9B44-4A8E-9374-CC747900FCBD}"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\TypeLib	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\TypeLib	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\ = "stmafmrem Object"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib\ = "{FDCF968A-9B44-4A8E-9374-CC747900FCBD}"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\LocalServer32\ = "C:\\CreaTec\\STMAFM20220402\\Pstmafm.exe"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Pstmafm.stmafmrem\ = "stmafmrem Object"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\TypeLib\Version = "1.0"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\TypeLib\Version = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}\ProxyStubClsid32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\ProgID\ = "Pstmafm.stmafmrem"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib\{FDCF968A-9B44-4A8E-9374-CC747900FCBD}\1.0\HELPDIR	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\ = "Istmafmrem"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ProxyStubClsid32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\ProxyStubClsid32	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\Interface\{D987154C-A6AB-473D-8879-366D509BFFCF}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\ = "Istmafmuser"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}\TypeLib	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{D4FC24E5-12A1-490D-828B-C3A8A46A32F1}\Version\ = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\TypeLib	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{C843CD27-38E0-4789-AF65-A6FAB0BE20B7}\ = "Istmafmrem"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}	Pstmafm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{299E6FC8-077A-4D09-ADED-0054FDAE78E6}\TypeLib\Version = "1.0"	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Interface\{9E2296E9-B122-432C-9CD1-6D3BF051F7BD}	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\Version	Pstmafm.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Wow6432Node\CLSID\{1D37EB7C-BF29-44DC-8138-EC1A9B212DB4}\TypeLib	Pstmafm.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.tmpPstmafm.exePstmafm.exe

pid	process
1232	setup_pstmafm44x_20220402_Beta.tmp
1232	setup_pstmafm44x_20220402_Beta.tmp
1544	Pstmafm.exe
1544	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.tmp

pid process

1232 setup_pstmafm44x_20220402_Beta.tmp
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

Pstmafm.exePstmafm.exe

pid process

1544 Pstmafm.exe
568 Pstmafm.exe
568 Pstmafm.exe
568 Pstmafm.exe
568 Pstmafm.exe

pid	process
1544	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe
568	Pstmafm.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

setup_pstmafm44x_20220402_Beta.exesetup_pstmafm44x_20220402_Beta.tmpPstmafm.exe

description	pid	process	target process
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1652 wrote to memory of 1232	1652	setup_pstmafm44x_20220402_Beta.exe	setup_pstmafm44x_20220402_Beta.tmp
PID 1232 wrote to memory of 1544	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 1544	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 1544	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 1544	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 568	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 568	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 568	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 1232 wrote to memory of 568	1232	setup_pstmafm44x_20220402_Beta.tmp	Pstmafm.exe
PID 568 wrote to memory of 1324	568	Pstmafm.exe	STMAFMDSPforWindows.exe
PID 568 wrote to memory of 1324	568	Pstmafm.exe	STMAFMDSPforWindows.exe
PID 568 wrote to memory of 1324	568	Pstmafm.exe	STMAFMDSPforWindows.exe
PID 568 wrote to memory of 1324	568	Pstmafm.exe	STMAFMDSPforWindows.exe

C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe
"C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp" /SL5="$70124,29710762,721408,C:\Users\Admin\AppData\Local\Temp\setup_pstmafm44x_20220402_Beta.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1232

C:\CreaTec\STMAFM20220402\Pstmafm.exe
"C:\CreaTec\STMAFM20220402\Pstmafm.exe" /regserverperuser
3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1544

C:\CreaTec\STMAFM20220402\Pstmafm.exe
"C:\CreaTec\STMAFM20220402\Pstmafm.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568

C:\CreaTec\STMAFM20220402\STMAFMDSPforWindows.exe
"C:\CreaTec\STMAFM20220402\STMAFMDSPforWindows.exe" 51599
4⤵
- Executes dropped EXE
PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72.3MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
C:\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72.3MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
C:\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72.3MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
C:\CreaTec\STMAFM20220402\STMAFMDSPforWindows.exe
Filesize
192KB

MD5
c61d77e8f0d3a97d4f7f7422d6b3a9e6

SHA1
e8600b6c645b4430dcaa801cd3c9c705930e8989

SHA256
1bdca23795e20381421a61a2faf4ea8c7f482c77c00d8f13fd54ad5959dba2d9

SHA512
2b709bcdcfeb9dfa7705b128217ccba194cdb40ad0b37c3cecbdc323542235d3347252ee6e599b4e85561a001bd7c23168663a4f42b72b6368c316e99fd05136

Download Submit
C:\CreaTec\STMAFM20220402\stmafmdspforwindows.exe
Filesize
192KB

MD5
c61d77e8f0d3a97d4f7f7422d6b3a9e6

SHA1
e8600b6c645b4430dcaa801cd3c9c705930e8989

SHA256
1bdca23795e20381421a61a2faf4ea8c7f482c77c00d8f13fd54ad5959dba2d9

SHA512
2b709bcdcfeb9dfa7705b128217ccba194cdb40ad0b37c3cecbdc323542235d3347252ee6e599b4e85561a001bd7c23168663a4f42b72b6368c316e99fd05136

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp
Filesize
2.4MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp
Filesize
2.4MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72.3MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72.3MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
\CreaTec\STMAFM20220402\Pstmafm.exe
Filesize
72.3MB

MD5
dcb1f1435fb46fad630c8b9129147a5c

SHA1
fed0fe9504b20b418d8b9e7e888e2fccd7cd1d3d

SHA256
7b38c085ce079d44bef29334efad403711e2f3c23bbf189e7d7024af9ec2127e

SHA512
4fe4f55d8f8cfd435fbdd5009f26918e8287a37f26b10ead24b0f8fba687e762814d72c3048ae43b47db22c13129225daf161378db990d2dfe8a4450ed4b410a

Download Submit
\CreaTec\STMAFM20220402\stmafmdspforwindows.exe
Filesize
192KB

MD5
c61d77e8f0d3a97d4f7f7422d6b3a9e6

SHA1
e8600b6c645b4430dcaa801cd3c9c705930e8989

SHA256
1bdca23795e20381421a61a2faf4ea8c7f482c77c00d8f13fd54ad5959dba2d9

SHA512
2b709bcdcfeb9dfa7705b128217ccba194cdb40ad0b37c3cecbdc323542235d3347252ee6e599b4e85561a001bd7c23168663a4f42b72b6368c316e99fd05136

Download Submit
\CreaTec\STMAFM20220402\stmafmdspforwindows.exe
Filesize
192KB

MD5
c61d77e8f0d3a97d4f7f7422d6b3a9e6

SHA1
e8600b6c645b4430dcaa801cd3c9c705930e8989

SHA256
1bdca23795e20381421a61a2faf4ea8c7f482c77c00d8f13fd54ad5959dba2d9

SHA512
2b709bcdcfeb9dfa7705b128217ccba194cdb40ad0b37c3cecbdc323542235d3347252ee6e599b4e85561a001bd7c23168663a4f42b72b6368c316e99fd05136

Download Submit
\Users\Admin\AppData\Local\Temp\is-OSHT7.tmp\setup_pstmafm44x_20220402_Beta.tmp
Filesize
2.4MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
memory/568-70-0x0000000000000000-mapping.dmp

Download
memory/1232-62-0x0000000074421000-0x0000000074423000-memory.dmp

Filesize
8KB

Download
memory/1232-58-0x0000000000000000-mapping.dmp

Download
memory/1324-78-0x0000000000000000-mapping.dmp

Download
memory/1544-65-0x0000000000000000-mapping.dmp

Download
memory/1652-61-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1652-73-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1652-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download