5f26ba6ce5a487a3c9ec7663143f6d661c5500d0dd593274bd4ab6e78815d236

Analysis

max time kernel
35s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2024 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uiso9_pe.exe
Size

4.9MB
MD5

5a2000a241a6947c060ee63425d7ebef
SHA1

d80bbe4769b5e00886797d6f7c30063031eb5699
SHA256

5f26ba6ce5a487a3c9ec7663143f6d661c5500d0dd593274bd4ab6e78815d236
SHA512

cf4155b56d878d1d4c8b18669d6aa700c626fa5b2f67719bb8b2f8378059003046f437ae223a7aef6336d95cb82eeeb057910a432c135bbc4d94619a8bbfde1a
SSDEEP

98304:JUj8/4MycvvCf9uOj5zXSdcrRsMZtuS0xbN0yjqnolKIMPgZrx/CpSSMD/zCDK8:Oj3MychOBXSdclsotcYyEGMPqrxo0zCP

Score

4^/10

discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UltraISO\lang\is-EMD5U.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-0MF1P.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-RNR2K.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-J4B7I.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-JMD28.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-UA78Q.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-OQRVO.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-QFVE6.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-EVCN6.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\Common Files\EZB Systems\is-JNM6M.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-O3VKQ.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-7SMTR.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-UEHPC.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-LQT18.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-3H7NL.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-U6U02.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-ISG9G.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-RDSHN.tmp	uiso9_pe.tmp
File opened for modification	C:\Program Files (x86)\UltraISO\backup	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-H4ICQ.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-LA6BN.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-6QTU8.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-TEIL5.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-7FUOP.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-TH42S.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-LDSG4.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-35QBV.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-JI8EE.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-TDEIA.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-MBO3V.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-EVUFS.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-O9673.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-EA8I8.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-88OR0.tmp	uiso9_pe.tmp
File opened for modification	C:\Program Files (x86)\UltraISO\unins000.dat	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-MF0AK.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-L9F1H.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-FE4IL.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-PEE6K.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-99837.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-0B0DM.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-0GFKQ.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-576UC.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-94Q3Q.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-ENBBN.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-UH4B1.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-LV1AH.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-PBAVB.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-UQR8D.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-30DAD.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-V6NOO.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-0R5HO.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-R33AA.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-J3QME.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-96F8Q.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-7TF99.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-OFV4H.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-OVLRL.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-4V8CA.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\unins000.dat	uiso9_pe.tmp

Executes dropped EXE 3 IoCs

pid	Process
4652	uiso9_pe.tmp
3868	isocmd.exe
3600	UltraISO.exe

Loads dropped DLL 2 IoCs

pid	Process
2440	regsvr32.exe
3600	UltraISO.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\""	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers\ISOShell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\VersionIndependentProgID\ = "ISOShell.UIContextMenu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\Convert to ISO\command	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\0\win64\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\ = "BIN File"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib\ = "{1CD46142-F3D3-4E46-87BA-7CC019142F9D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso\ = "UltraISO"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltraISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\DefaultIcon	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UltraISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\ = "ISOShell 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz\ = "UltraISO"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\""	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bin\ = "binimage"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\Convert to ISO	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers\ISOShell\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers\ISOShell\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ui	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\DefaultIcon\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\",0"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ = "IUIContextMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\UltraISO	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\UltraISO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers\ISOShell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\ = "UIContextMenu Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\ = "UIContextMenu Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ProgID\ = "ISOShell.UIContextMenu.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\ = "Open with &UltraISO"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32	regsvr32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4768	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4768	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4652	uiso9_pe.tmp

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4652	3680	uiso9_pe.exe	83
PID 3680 wrote to memory of 4652	3680	uiso9_pe.exe	83
PID 3680 wrote to memory of 4652	3680	uiso9_pe.exe	83
PID 4652 wrote to memory of 2440	4652	uiso9_pe.tmp	91
PID 4652 wrote to memory of 2440	4652	uiso9_pe.tmp	91
PID 4652 wrote to memory of 3868	4652	uiso9_pe.tmp	92
PID 4652 wrote to memory of 3868	4652	uiso9_pe.tmp	92
PID 4652 wrote to memory of 3868	4652	uiso9_pe.tmp	92
PID 4652 wrote to memory of 3600	4652	uiso9_pe.tmp	95
PID 4652 wrote to memory of 3600	4652	uiso9_pe.tmp	95
PID 4652 wrote to memory of 3600	4652	uiso9_pe.tmp	95

C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe
"C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\is-LHQL3.tmp\uiso9_pe.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LHQL3.tmp\uiso9_pe.tmp" /SL5="$C0050,4629041,128512,C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:2440
- - C:\Program Files (x86)\UltraISO\drivers\isocmd.exe
    "C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -i
    3⤵
    - Executes dropped EXE
    PID:3868
- - C:\Program Files (x86)\UltraISO\UltraISO.exe
    "C:\Program Files (x86)\UltraISO\UltraISO.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ac 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\EZB Systems\lame_enc.dll

Filesize
962KB

MD5
b9e34ae6d6ecb1e19b36dc70e7ef406c

SHA1
014985ed2dab57e606e08788fc9177220dd2aed1

SHA256
3b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4

SHA512
d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2

Download Submit
C:\Program Files (x86)\Common Files\EZB Systems\lame_enc.dll

Filesize
896KB

MD5
42b9b1556d0101ef8007a7bf92ad914c

SHA1
8fcf145f5cba60075dba783f96b3ffe934aedfe9

SHA256
7e6093e8c4032eee6ded7026c9d326606f380e2c63426eece22d5c04ac111e6e

SHA512
425e5c073c65498160e213dc40e7081a7cda301bd3bf3484fcb8bc857c6a0b7c49ac6b5fef150bf06e1c3377b44e99c38d0db5523e5cbcac4b69383fac209126

Download Submit
C:\Program Files (x86)\UltraISO\UltraISO.exe

Filesize
5.2MB

MD5
63285e1d8a23ad23dd5b163feb715059

SHA1
67ee1910b3dd150a1297367dacdb4b272db01644

SHA256
116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be

SHA512
d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7

Download Submit
C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys

Filesize
132KB

MD5
bc81814b594286bef9913ec5ca1110d7

SHA1
523fc3b657fd3fb493e0fb14c0bbf39813d1e558

SHA256
9c22b6f77e929d319c5e891ee1510045dc5f486bdaf47a0696564d4d84d30379

SHA512
2b65dc57a4c83c1ef243396dabf15cf53faa145bd073ac89dbf9104519e7a2b97a303c96acfdbc992e9ac19efbe65b143dd27bb6c9f7ad3e76c5eacb1b9a1889

Download Submit
C:\Program Files (x86)\UltraISO\drivers\IsoCmd.exe

Filesize
28KB

MD5
55677a521dd34ce7a93ab3f1d12b2dfd

SHA1
4316dd2b5e4ebb48886955ec5365b2f40d4298b3

SHA256
fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c

SHA512
e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc

Download Submit
C:\Program Files (x86)\UltraISO\isoshl64.dll

Filesize
151KB

MD5
c0fc6c67bd9d9fbc4f8ad44232d49d11

SHA1
e5ad2b56cc20652401ee5c60fe118cf3fb474a7b

SHA256
50df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503

SHA512
74bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LHQL3.tmp\uiso9_pe.tmp

Filesize
771KB

MD5
3de2992c86c78e781881e9c0db26a32f

SHA1
c26845ca7319a66432304a955cecdad4f977d040

SHA256
e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642

SHA512
88d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6

Download Submit
memory/3600-162-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/3600-155-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3600-159-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/3680-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3680-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3680-158-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3680-2-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4652-145-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/4652-157-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/4652-154-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4652-9-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/4652-6-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads