5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e

General

Target

5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Size

1.2MB
MD5

7819aded07f95ebb40f51240514d6097
SHA1

3b0c674320f1e1e7401f8e49c0af22f10963a99f
SHA256

5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e
SHA512

c55ab9344ad0b6ee3c3ab6d5833ae1867b28efd97599b452d959a66543eb8e65b10ec1aa6377219a6d35c410643fb35084b9d77ef117c67c691dec1623c23e1f
SSDEEP

24576:EnXIlq0d3uCOle3bcSNR+Jr2zZ8zYzAKOorc+B2Cnoy2KFg:Et6dsMAKjcDWF

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe

pid process

1720 5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 24 IoCs

Processes:

5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a00310000000000000000001200383837370000360008000400efbe00000000000000002a000000000000000000000000000000000000000000000000003800380037003700000014000000	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5e0031000000000000000000100050726f6772616d4461746100440008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000500072006f006700720061006d00440061007400610000001a000000	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe

pid	process
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe

description	pid	process
Token: SeDebugPrivilege	1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
Token: SeDebugPrivilege	1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1692 DllHost.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exemsconfig.exemsconfig.exe

pid process

1720 5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1920 msconfig.exe
1920 msconfig.exe
1784 msconfig.exe
1784 msconfig.exe

pid	process
1692	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
"C:\Users\Admin\AppData\Local\Temp\5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1720

C:\Windows\System32\msconfig.exe
"C:\Windows\System32\msconfig.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Windows\System32\msconfig.exe
"C:\Windows\System32\msconfig.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1784

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.jpg

Filesize
1KB

MD5
edea599abe007c19c028c6917a16cd0e

SHA1
f6c89bbd3167c265b8f1f946c6c5a4e5d5a93771

SHA256
c7be415cca4726d7ed856ce13481862c96978a5dd880b926cc6c29f95b6d57dd

SHA512
9e839c1d91b067fdd9e4356b99dbfc1a46dff9c796bd9c4455d1cf9b6da46ecc64b0c35be47382f5f2b059876ab7a8f686ec304f54b56c24a358e4868fd46b16

Download Submit
\Users\Admin\AppData\Local\Temp\Unrar.dll

Filesize
157KB

MD5
a5fe51b8ce661a935a165803c65a4bf1

SHA1
f62c77748f4ea5ab4c1b0c987e568e04e86e43ee

SHA256
5a190418b2f5e7fc18ad27ac315b21df185bba8c0e33dc0b3ce60fe07ef34441

SHA512
6b52f099b0b9d789663bc6fe833c7212c09d5e6e50fceabfdb9e94bcd1ef911fb3304b247da5fc90ac4739cfd485729883d2c5f64af4f87681fdea1216fc1017

Download Submit
memory/1692-84-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/1692-85-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1692-89-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1720-58-0x0000000001FB0000-0x0000000001FE2000-memory.dmp

Filesize
200KB

Download
memory/1720-79-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1720-80-0x0000000001FB0000-0x0000000001FE2000-memory.dmp

Filesize
200KB

Download
memory/1720-83-0x0000000002140000-0x0000000002142000-memory.dmp

Filesize
8KB

Download

pid	process
1720	5e34b52fb24804b7f2709926d57582f34f1d6b351284a15d52d0194635b2dc7e.exe
1920	msconfig.exe
1920	msconfig.exe
1784	msconfig.exe
1784	msconfig.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads