90253a8d6f9670668b7e20d5eaafa59081674c2fa547d85e472ae61a00933cd4

General

Target

993ad3fa6dbef1ce5a9a0ab45eba1e56.exe
Size

181KB
MD5

993ad3fa6dbef1ce5a9a0ab45eba1e56
SHA1

29260f9aef64454d0f6ac35c0bb772e94d975725
SHA256

90253a8d6f9670668b7e20d5eaafa59081674c2fa547d85e472ae61a00933cd4
SHA512

b71ca010424977c2d95af42fe8502d806b8839209054a4bb8a65f6455d8229cf370aa3c3a61fbe7b8eea0ffaafe1ead2df7d94621b93d8b5a1f003d4f458864d
SSDEEP

3072:uHZxhrqtQuUkP9XsZUD1yGw8aUEDMnud7/Z8mVAfSil1wMRN7p8QoGCFUwzwQ0+9:UqtQ7MRFD1yGvaZM7mw1wWN2GPwrW8

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	REGSVR.EXE

Disables Task Manager via registry modification
evasion

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-11C0-821H-444200140P0S}	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\Tapi32init.exe"	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-11C0-821H-444200140P0S}	REGSVR.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\Tapi32init.exe"	REGSVR.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe

Deletes itself 1 IoCs

pid	Process
4852	REGSVR.EXE

Executes dropped EXE 1 IoCs

pid	Process
4852	REGSVR.EXE

Loads dropped DLL 2 IoCs

pid	Process
4852	REGSVR.EXE
4852	REGSVR.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Tapi32init.exe	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe
File created	C:\Windows\SysWOW64\Tapi32init.exe	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\REGSVR.EXE	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe
File created	C:\Windows\REGSVR.EXE	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4852	REGSVR.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4852	1976	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe	86
PID 1976 wrote to memory of 4852	1976	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe	86
PID 1976 wrote to memory of 4852	1976	993ad3fa6dbef1ce5a9a0ab45eba1e56.exe	86

C:\Users\Admin\AppData\Local\Temp\993ad3fa6dbef1ce5a9a0ab45eba1e56.exe
"C:\Users\Admin\AppData\Local\Temp\993ad3fa6dbef1ce5a9a0ab45eba1e56.exe"
1⤵
- Disables RegEdit via registry modification
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\REGSVR.EXE
  "C:\Windows\REGSVR.EXE" C:\Users\Admin\AppData\Local\Temp\993ad3fa6dbef1ce5a9a0ab45eba1e56.exe
  2⤵
  - Disables RegEdit via registry modification
  - Modifies Installed Components in the registry
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eshgh.jpg

Filesize
167KB

MD5
e0b6b7da6549183b91bdef956bf6517c

SHA1
4cc3e1aeb7a7f85bcca43a93e10a3a421b4b404b

SHA256
824e67dde1a27543c472ac49334781a2ba470d05e3d72f4c54675096e323971a

SHA512
6156ccde6922ba93ff652b9382410d1c05a8cce9c507cb46095c7b0f395e52bf5b237857e6d0e64d5a21636c6b7543e7222137f96879db3149941c513292ef77

Download Submit
C:\Windows\SysWOW64\Tapi32init.exe

Filesize
181KB

MD5
993ad3fa6dbef1ce5a9a0ab45eba1e56

SHA1
29260f9aef64454d0f6ac35c0bb772e94d975725

SHA256
90253a8d6f9670668b7e20d5eaafa59081674c2fa547d85e472ae61a00933cd4

SHA512
b71ca010424977c2d95af42fe8502d806b8839209054a4bb8a65f6455d8229cf370aa3c3a61fbe7b8eea0ffaafe1ead2df7d94621b93d8b5a1f003d4f458864d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads