82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d

General

Target

82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe
Size

174KB
MD5

0e887906731ae21c61aead24848a5592
SHA1

39c939ebbda0dfd802c411a7cd483b25f2a2ae38
SHA256

82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d
SHA512

5333468dee21e886017ac25049c842f324a26d9b27258d3f2c1a9b6ec79002a473ce9aea99157b9c3d8dced438540d217f380adca0a3c36b53833b3915ce9cb2
SSDEEP

3072:aYOoXSH2e5kqL7RJsgQKxF//tUPzsFstheQ1/9J5B+oQc5O1/EY7:aYfSr5khgQKD//C4FSx1/XD+RTxE

Score

8^/10

discovery persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe

pid process

1124 82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

268 explorer.exe

pid	process
1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exeexplorer.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe
Token: SeDebugPrivilege	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: 33	784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	784	AUDIODG.EXE
Token: 33	784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	784	AUDIODG.EXE
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

explorer.exe

pid	process
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

explorer.exe

pid	process
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe

description	pid	process	target process
PID 1124 wrote to memory of 292	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	regsvr32.exe
PID 1124 wrote to memory of 292	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	regsvr32.exe
PID 1124 wrote to memory of 292	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	regsvr32.exe
PID 1124 wrote to memory of 292	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	regsvr32.exe
PID 1124 wrote to memory of 292	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	regsvr32.exe
PID 1124 wrote to memory of 292	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	regsvr32.exe
PID 1124 wrote to memory of 292	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	regsvr32.exe
PID 1124 wrote to memory of 268	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	explorer.exe
PID 1124 wrote to memory of 268	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	explorer.exe
PID 1124 wrote to memory of 268	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	explorer.exe
PID 1124 wrote to memory of 268	1124	82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe
"C:\Users\Admin\AppData\Local\Temp\82c8c9a80c78d9d4145ad535cd49562df59e26c2c3a8b778233e59bc9d83f20d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /u /s "C:\Users\lenovo\AppData\Local\YunPan\Bin\x64\YuWangExt.dll"
2⤵
PID:292

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x588
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:784

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-60-0x0000000000000000-mapping.dmp

Download
memory/268-61-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download
memory/268-63-0x0000000001E80000-0x0000000001E90000-memory.dmp

Filesize
64KB

Download
memory/292-58-0x0000000000000000-mapping.dmp

Download
memory/1124-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/1124-56-0x00000000013B0000-0x0000000001418000-memory.dmp

Filesize
416KB

Download
memory/1124-55-0x00000000013B0000-0x0000000001418000-memory.dmp

Filesize
416KB

Download
memory/1124-57-0x00000000013B0000-0x0000000001418000-memory.dmp

Filesize
416KB

Download
memory/1124-62-0x00000000013B0000-0x0000000001418000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads