e7a5581c792dc91b7513887117db26464c33f886eccd9df9c9749d32b819f9fe

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e25c9271d54263de1794a6e080ff25f.exe
Size

14KB
MD5

3e25c9271d54263de1794a6e080ff25f
SHA1

bc045cf7dedb7f5765d99d90bb908a6f775c2c27
SHA256

e7a5581c792dc91b7513887117db26464c33f886eccd9df9c9749d32b819f9fe
SHA512

3ad266285bb91bc56e31329f62779582f726e42f35df103f2891ac0d630e328bc16c4a1dbc86135cc1ee1843eb7b93d75d016be1196ea363446e3d415761937c
SSDEEP

384:Rt71IDxJqHM6UdoqHxBmSSLKEhy+n5rvS9uV0pcjr:lGxsHNQoU7ib5nY8Ve4

Score

10^/10

persistence upx

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\C:\Windows\Fonts\pacnxqfh.dll = "{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}"	3e25c9271d54263de1794a6e080ff25f.exe

Deletes itself 1 IoCs

pid	Process
2740	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
760	3e25c9271d54263de1794a6e080ff25f.exe
2476	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/760-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/760-8-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\d091015.dat	3e25c9271d54263de1794a6e080ff25f.exe
File created	C:\Windows\Fonts\pacnxqfh.tmp	3e25c9271d54263de1794a6e080ff25f.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl.1\ = "dhwzatl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\TypeLib\ = "{FC0960C3-16EB-4C98-A622-30E032F606E3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl\CLSID\ = "{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl\CurVer\ = "Dhwz.dhwzatl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\ = "dhwzatl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\InprocServer32\ = "C:\\Windows\\Fonts\\pacnxqfh.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\TypeLib\ = "{FC0960C3-16EB-4C98-A622-30E032F606E3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl.1\CLSID\ = "{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0\HELPDIR\ = "C:\\Windows\\Fonts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\ProgID\ = "Dhwz.dhwzatl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\ = "Idhwzatl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\ = "Idhwzatl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0\0\win32\ = "C:\\Windows\\Fonts\\pacnxqfh.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl\ = "dhwzatl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dhwz.dhwzatl\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\VersionIndependentProgID\ = "Dhwz.dhwzatl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0\ = "dhwz 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC0960C3-16EB-4C98-A622-30E032F606E3}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9F5EDFC-3EB9-48FA-B292-A8E1055EB1DD}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF12F8AB-9A00-469C-B9D4-425C1BE3E1E6}\TypeLib\ = "{FC0960C3-16EB-4C98-A622-30E032F606E3}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
760	3e25c9271d54263de1794a6e080ff25f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	760	3e25c9271d54263de1794a6e080ff25f.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
760	3e25c9271d54263de1794a6e080ff25f.exe
760	3e25c9271d54263de1794a6e080ff25f.exe
760	3e25c9271d54263de1794a6e080ff25f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2476	760	3e25c9271d54263de1794a6e080ff25f.exe	28
PID 760 wrote to memory of 2476	760	3e25c9271d54263de1794a6e080ff25f.exe	28
PID 760 wrote to memory of 2476	760	3e25c9271d54263de1794a6e080ff25f.exe	28
PID 760 wrote to memory of 2476	760	3e25c9271d54263de1794a6e080ff25f.exe	28
PID 760 wrote to memory of 2476	760	3e25c9271d54263de1794a6e080ff25f.exe	28
PID 760 wrote to memory of 2476	760	3e25c9271d54263de1794a6e080ff25f.exe	28
PID 760 wrote to memory of 2476	760	3e25c9271d54263de1794a6e080ff25f.exe	28
PID 760 wrote to memory of 2740	760	3e25c9271d54263de1794a6e080ff25f.exe	31
PID 760 wrote to memory of 2740	760	3e25c9271d54263de1794a6e080ff25f.exe	31
PID 760 wrote to memory of 2740	760	3e25c9271d54263de1794a6e080ff25f.exe	31
PID 760 wrote to memory of 2740	760	3e25c9271d54263de1794a6e080ff25f.exe	31

C:\Users\Admin\AppData\Local\Temp\3e25c9271d54263de1794a6e080ff25f.exe
"C:\Users\Admin\AppData\Local\Temp\3e25c9271d54263de1794a6e080ff25f.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Windows\Fonts\pacnxqfh.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\3E25C9~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Fonts\pacnxqfh.dll

Filesize
36KB

MD5
4c1893a31e24f740b2ed07fdc3e586e5

SHA1
0e45ea3a2d83e370962b4109bfff73742b1d0808

SHA256
c51c8a62516d5abf5c43dd83df18571679dafdf3289f7e8247d20892bb36c410

SHA512
1ce95eca6f5492653f36999f9a85c85cc7d913efb8f6cc14fb3627fe742cd37ec74a1c979c8be228e508208e7974aeacbb29e9cf9a0df55f394124cf54999c9d

Download Submit
memory/760-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/760-8-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/760-9-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/760-16-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2476-7-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download