e45993f2ed9e4c75c4248ffd700011d3766da4bed7bcf1206ff8657be05f1a95

Analysis

max time kernel
129s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

79c5fa069d782072ccd8471534a91a44.exe
Size

228KB
MD5

79c5fa069d782072ccd8471534a91a44
SHA1

51172b2c774036ca82f68f524fbbf8850e8fdbb8
SHA256

e45993f2ed9e4c75c4248ffd700011d3766da4bed7bcf1206ff8657be05f1a95
SHA512

706557a517cd1eff0c62447c752d3ea9f096fb7cbece2d58c77fb3b7adbcbeb037dd5fc21381a652bf92220c61276fa4f33e6f5145ec27b3fafb11b9ed293520
SSDEEP

3072:btkwP3n314oNx0iJKmmzuVaVvOTwl/lAwSLRjhRx/hrulRBTH7PLCEbEFIrvDC:b+wP3nzql/uNRjhR7uRB7aY

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}\Version = "12,0,19041,1266"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\Version = "12,0,19041,1266"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\Version = "12,0,19041,1266"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,19041,1266"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\ = "Проигрыватель Windows Media (Microsoft) 12.0"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}\Version = "12,0,19041,1266"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,19041,1266"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	79c5fa069d782072ccd8471534a91a44.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wmsetup.log	79c5fa069d782072ccd8471534a91a44.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	79c5fa069d782072ccd8471534a91a44.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wma\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\. = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wmafile	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex\ContextMenuHandlers\WMPBurnAudioCD	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Compressors	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions\WAV	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.dvr-ms\Media Type = "{e436eb83-524f-11ce-9f53-0020af0ba770}"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\RIFFHandlers\WAVE	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmv	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.asf = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions\AVI	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\RIFFHandlers\AVI	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asf	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asf\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wm\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wma	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.dvr-ms\Source Filter = "{C9F5FE02-F851-4eb5-99EE-AD602AF1E619}"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmdb	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile\DefaultIcon	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile\DefaultIcon\ = "C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe,-120"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wvx = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\RIFFHandlers	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asx\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmv\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Compressors\auds	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{33FACFE0-A9BE-11d0-A520-00A0D10129C0\0 = "0,4,ffdfdfdf,3C53414d"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmx	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wvx	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex\ContextMenuHandlers	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wax\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmx\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u\SubType = "{a98c8400-4181-11d1-a520-00a0d10129c0}"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{33FACFE0-A9BE-11d0-A520-00A0D10129C0	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wm	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wm = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Compressors\vids	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile\NoOpen	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.asp = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wmv = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMST\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSBD\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wax	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex\ContextMenuHandlers	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMS	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMS\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMSU\Animation = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wma = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex\ContextMenuHandlers\WMPBurnAudioCD\ = "{8DD448E6-C188-4aed-AF92-44956194EB1F}"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions\AU	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u\Source Filter = "{e436ebb5-524f-11ce-9f53-0020af0ba770}"	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.dvr-ms	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMST	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMSU	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{083863F1-70DE-11d0-BD40-00A0C911CE86}	79c5fa069d782072ccd8471534a91a44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmdb\ = "WMP.WMDBFile"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wax = "dxmasf.dll,150"	79c5fa069d782072ccd8471534a91a44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex\ContextMenuHandlers\WMPBurnAudioCD\ = "{8DD448E6-C188-4aed-AF92-44956194EB1F}"	79c5fa069d782072ccd8471534a91a44.exe

C:\Users\Admin\AppData\Local\Temp\79c5fa069d782072ccd8471534a91a44.exe
"C:\Users\Admin\AppData\Local\Temp\79c5fa069d782072ccd8471534a91a44.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads