6657525f9351d6f04591054096eabafb232ebb12b8f10c7fcc3277acc3aa70e7

Analysis

max time kernel
42s
max time network
35s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_1.4.3.exe
Size

27.7MB
MD5

1f659e1db069675c1d5a0fe7bc0b5739
SHA1

b9d4bbb302da889d91a88f6f420314df49cb5a1d
SHA256

6657525f9351d6f04591054096eabafb232ebb12b8f10c7fcc3277acc3aa70e7
SHA512

828e2c6487e7f7779580798842b751d96fda362d1c6972f434f033eb92e049204b0c5384eb988e162e67aa73ad4242f38dbe3523353c4e4f14cc35c5f3d6a02b
SSDEEP

786432:uxUgFWevgSND3mcwKnjPa8B36qLQ4IOFDaM:RGXv/3H77d36qLQ4I+aM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1744	setup_1.4.3.tmp

Loads dropped DLL 1 IoCs

pid	Process
2000	setup_1.4.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	setup_1.4.3.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "1"	setup_1.4.3.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_FolderType = "{C1F8339F-F312-4C97-B1C6-ECDF5910C5C0}"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	setup_1.4.3.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_FolderType = "{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}"	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\MRUListEx = ffffffff	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 740000001a00eebbfe23000010009fae90a93ba0804e94bc9912d750410400002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000001900efbeebaa2b0b4200ca4daa4d3ee8648d03e58207ba827a5b6945b5d7ec83085f08cc20000000	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 = ae0500007e05811914105405200000000060000000000000000000000000000000000000000000000000000100005a0000003153505330f125b7ef471a10a5f102608c9eebac310000000a000000001f00000010000000530061006d0070006c00650020005000690063007400750072006500730000000d0000000c0000000001000000000000003100000031535053b1166d44ad8d7048a748402ea43d788c15000000640000000015000000d3467778910a914d00000000bc02000031535053a66a63283d95d211b5d600c04fd918d0110000001900000000130000007f018070390200002000000000111000002502000014001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000007400310000000000545757a61100557365727300600008000400efbeee3a851a545757a62a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d00320031003800310033000000140078003100000000008c3e854311005075626c69630000620008000400efbeee3a851a8c3e85432a0000007c0200000000010000000000000000003800000000005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016007e00310000000000ee3acd26110050696374757265730000660008000400efbeee3a851aee3acc262a000000840200000000010000000000000000003c000000000050006900630074007500720065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380030003200000018008c00310000000000ee3acd26110053414d504c457e310000740008000400efbeee3a142cee3a142c2a000000850200000000010000000000000000004a0000000000530061006d0070006c006500200050006900630074007500720065007300000040007300680065006c006c00330032002e0064006c006c002c002d00320031003800300035000000180000000000003100000018000000001f00000010000000530061006d0070006c0065002000500069006300740075007200650073000000250000000b000000001f0000000a0000004400690072006500630074006f00720079000000000000004d00000031535053e05acf415af70648bd8759c7d9248eb93100000064000000001f00000010000000530061006d0070006c0065002000500069006300740075007200650073000000000000002d00000031535053901c6949177e1a10a91c08002b2ecda91100000003000000000300000000000000000000002c0100003153505340e83e1e2bbc6c4782372acd1a839b226500000008000000001f0000002900000043003a005c00550073006500720073005c005000750062006c00690063005c00500069006300740075007200650073005c00530061006d0070006c006500200050006900630074007500720065007300000000002500000003000000001f100000010000000700000066006f006c006400650072000000000011000000140000000003000000010000007500000011000000001f000000310000007b00310036003800350044003400410042002d0041003500310042002d0034004100460031002d0041003400450035002d004300450045003800370030003000320034003300310044007d002e004d006500720067006500200041006e00790000000000000000003600000031535053fcb3b4b9512b424ab5d8324146afcf250d0000000800000000010000000d000000020000000001000000000000002d00000031535053c0e85bcf6c23d34abacecd608a2748d71100000064000000000b000000ffff0000000000000000000000002a0000000000efbe9f33f8c112f3974cb1c6ecdf5910c5c08207ba827a5b6945b5d7ec83085f08cc84050000	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	setup_1.4.3.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	setup_1.4.3.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a0000000e0859ff2f94f6810ab9108002b27b3d9050000005800000030f125b7ef471a10a5f102608c9eebac0c00000050000000920444648b4cd1118b70080036b11a030900000060000000	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "3"	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\NodeSlot = "4"	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewVersion = "0"	setup_1.4.3.tmp
Key created	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 9e0000001a00eebbfe23000010009fae90a93ba0804e94bc9912d750410400002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbeebaa2b0b4200ca4daa4d3ee8648d03e58207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	setup_1.4.3.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	setup_1.4.3.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_TopViewVersion = "0"	setup_1.4.3.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1744	setup_1.4.3.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1744	setup_1.4.3.tmp
1744	setup_1.4.3.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1744	2000	setup_1.4.3.exe	28
PID 2000 wrote to memory of 1744	2000	setup_1.4.3.exe	28
PID 2000 wrote to memory of 1744	2000	setup_1.4.3.exe	28
PID 2000 wrote to memory of 1744	2000	setup_1.4.3.exe	28
PID 2000 wrote to memory of 1744	2000	setup_1.4.3.exe	28
PID 2000 wrote to memory of 1744	2000	setup_1.4.3.exe	28
PID 2000 wrote to memory of 1744	2000	setup_1.4.3.exe	28

C:\Users\Admin\AppData\Local\Temp\setup_1.4.3.exe
"C:\Users\Admin\AppData\Local\Temp\setup_1.4.3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\is-09VSD.tmp\setup_1.4.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-09VSD.tmp\setup_1.4.3.tmp" /SL5="$500EA,28166056,1076736,C:\Users\Admin\AppData\Local\Temp\setup_1.4.3.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1744

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-09VSD.tmp\setup_1.4.3.tmp

Filesize
3.3MB

MD5
a46306a5ddc16ffbbdc80138eacf10ae

SHA1
c55f9f7f8bfc4f3f114297b66efcd18e35c59fae

SHA256
260e09a4bc23195be41183372656149b050d6492e39ad8da1730915abc30c03b

SHA512
38c88d81ee9ad5101d43d4821c39d042c04d1e623f6398ede71c2c09d388a8b3848827024b224b61e26dac4d3e59c1270a46366ed13128706866312002b93a9f

Download Submit
\Users\Admin\AppData\Local\Temp\is-09VSD.tmp\setup_1.4.3.tmp

Filesize
3.3MB

MD5
a46306a5ddc16ffbbdc80138eacf10ae

SHA1
c55f9f7f8bfc4f3f114297b66efcd18e35c59fae

SHA256
260e09a4bc23195be41183372656149b050d6492e39ad8da1730915abc30c03b

SHA512
38c88d81ee9ad5101d43d4821c39d042c04d1e623f6398ede71c2c09d388a8b3848827024b224b61e26dac4d3e59c1270a46366ed13128706866312002b93a9f

Download Submit
memory/1744-21-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1744-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1744-20-0x0000000000400000-0x0000000000750000-memory.dmp

Filesize
3.3MB

Download
memory/1744-22-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/1744-23-0x00000000053C0000-0x00000000053C2000-memory.dmp

Filesize
8KB

Download
memory/1744-25-0x0000000000400000-0x0000000000750000-memory.dmp

Filesize
3.3MB

Download
memory/1744-26-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/1744-28-0x0000000000400000-0x0000000000750000-memory.dmp

Filesize
3.3MB

Download
memory/1744-30-0x0000000000400000-0x0000000000750000-memory.dmp

Filesize
3.3MB

Download
memory/2000-18-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2000-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download