26900de3817ddfb8f4632efa334306cf568c0aeced90430d8dce0201cc1b3695

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

028845e2dd5cf647b41149bfa46eb31a.exe
Size

3.1MB
MD5

028845e2dd5cf647b41149bfa46eb31a
SHA1

1a5d137b2add6aeec5a67e92a840bec17be1411f
SHA256

26900de3817ddfb8f4632efa334306cf568c0aeced90430d8dce0201cc1b3695
SHA512

7ab4ac72f27a7974b84df93d0c62f551cb6b12a6adcb728cb667754865ded41ce4bcd0d1e703b3bcf7a4ea17ede4eba3a6f5ebec0a956bce745dbabd4365fa44
SSDEEP

98304:c9NrOO53+sNi9XwgwfovJdXN0B7+skc9IW1dXgfC/MHmg:c7D53xi9XwgwA

Score

7^/10

aspackv2 persistence spyware stealer

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x002f00000001494e-8.dat	aspack_v212_v242

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	028845e2dd5cf647b41149bfa46eb31a.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	028845e2dd5cf647b41149bfa46eb31a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\com\comrepl.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\SysWOW64\com\MigRegDB.exe	028845e2dd5cf647b41149bfa46eb31a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	028845e2dd5cf647b41149bfa46eb31a.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\servicing\GC64\tzupd.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Speech\Common\sapisvr.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\ehome\MediaCenterWebLauncher.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFontCac#\0246845f487e5f33d3564eff578665a3\PresentationFontCache.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\ComSvcConfig.ni.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\ehome\ehvid.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\ehExtHost32.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\PresentationFontCache.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\SMSvcHost.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\ComSvcConfig.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\WsatConfig.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\WsatConfig\36ca2928b2191011831ab673861c6ac6\WsatConfig.ni.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\WsatConfig\9683999d889dc0b8782c782e2fc1aee5\WsatConfig.ni.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\WsatConfig.ni.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\LoadMxf.ni.exe$	028845e2dd5cf647b41149bfa46eb31a.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	028845e2dd5cf647b41149bfa46eb31a.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	028845e2dd5cf647b41149bfa46eb31a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	028845e2dd5cf647b41149bfa46eb31a.exe

C:\Users\Admin\AppData\Local\Temp\028845e2dd5cf647b41149bfa46eb31a.exe
"C:\Users\Admin\AppData\Local\Temp\028845e2dd5cf647b41149bfa46eb31a.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\905c0769f9a06c95a24ddf945\patcher.exe$

Filesize
51KB

MD5
08613896032f55ce50619698eb3a1dad

SHA1
a25befe62dd512bc5fe894d73cd4aa84a8c8a90d

SHA256
4aca47940983c5d9e54a12f618cc2b84daea5cffe48ced6b990cb7c7aed58e1a

SHA512
dab65f13364a815adfc883f2874bb79dfcb4cec9c634d21f6866c83a4a4e3a79954b92e85f3bac687a65f456951ebb3ac824e79d73616e5e04e88e42710d8c17

Download Submit
memory/1932-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1932-83-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads