Overview
overview
7Static
static
7a075393594...fd.exe
windows7-x64
3a075393594...fd.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$TEMP/AnVir.exe
windows7-x64
3$TEMP/AnVir.exe
windows10-2004-x64
3AnVir.exe
windows7-x64
3AnVir.exe
windows10-2004-x64
3AnvirHook65.dll
windows7-x64
1AnvirHook65.dll
windows10-2004-x64
1CoreTemp.exe
windows7-x64
1CoreTemp.exe
windows10-2004-x64
1CoreTemp64.exe
windows7-x64
1CoreTemp64.exe
windows10-2004-x64
1ROIntegration.dll
windows7-x64
1ROIntegration.dll
windows10-2004-x64
1VirusTotalUpload.exe
windows7-x64
1VirusTotalUpload.exe
windows10-2004-x64
1reg-organi...up.exe
windows7-x64
7reg-organi...up.exe
windows10-2004-x64
7tweaker.exe
windows7-x64
7tweaker.exe
windows10-2004-x64
7usbhdd.exe
windows7-x64
7usbhdd.exe
windows10-2004-x64
7Analysis
-
max time kernel
147s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2024 22:07
Behavioral task
behavioral1
Sample
a07539359433b9d0bad2a6d2965346fd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a07539359433b9d0bad2a6d2965346fd.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
$TEMP/AnVir.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/AnVir.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
AnVir.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
AnVir.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
AnvirHook65.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
AnvirHook65.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
CoreTemp.exe
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
CoreTemp.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
CoreTemp64.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
CoreTemp64.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
ROIntegration.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
ROIntegration.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
VirusTotalUpload.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
VirusTotalUpload.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
reg-organizer-setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
reg-organizer-setup.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
tweaker.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
tweaker.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
usbhdd.exe
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
usbhdd.exe
Resource
win10v2004-20240221-en
General
-
Target
reg-organizer-setup.exe
-
Size
3.5MB
-
MD5
012de0464f7e3097081e716b84549d7e
-
SHA1
fe8389f53f2f13cea4984233286a99b515cdef58
-
SHA256
ffc5f6d72d06c8d4d281c02c1f3b4d9029d57fa437af52d3b2666077e1705c38
-
SHA512
951a899d2936d083313a8381576ebd9e97acb057a043f97865afe2df621f343edd81f4e244462835e0a132c1e4b712af5c69d9c2529ca684d32905961b7b968d
-
SSDEEP
98304:zVf0cpo6EbOSzqYpCsw5apF5soRBIPGqYHk:ycp5EbOkCsvMoRAa
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2052 reg-organizer-setup.tmp -
Loads dropped DLL 4 IoCs
pid Process 2052 reg-organizer-setup.tmp 2052 reg-organizer-setup.tmp 2052 reg-organizer-setup.tmp 2052 reg-organizer-setup.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3432 wrote to memory of 2052 3432 reg-organizer-setup.exe 87 PID 3432 wrote to memory of 2052 3432 reg-organizer-setup.exe 87 PID 3432 wrote to memory of 2052 3432 reg-organizer-setup.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\reg-organizer-setup.exe"C:\Users\Admin\AppData\Local\Temp\reg-organizer-setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\is-06UOM.tmp\reg-organizer-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-06UOM.tmp\reg-organizer-setup.tmp" /SL5="$60120,3230230,140800,C:\Users\Admin\AppData\Local\Temp\reg-organizer-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5843305ffe1758a4e11bf7bf431149dc4
SHA1cb1b14aca9a0e6fe0ae1e9a1e7decb816553e745
SHA256175785cbf2c65943846d497727d7134f1ec85f1ded67e27a55fd4294933fc7ee
SHA51289b6983970ffa0732370a18aeac2ee093b0551f71131c1c544c74d930552bae825f1eb338ad8158b6e390b12d02be5be532e0fbb61c3157ddaf008bc3dfc5695
-
Filesize
633KB
MD5a970dc705c1226069b5dcf9814cc8d3f
SHA1d812130c174a1eecfddaa6696aad050b6b1af316
SHA25648d60b06be877fb6558a6ca91466d6d6e3be40647cab68dc33e29da4d78c68a8
SHA5120d99bea817273d3465738d245268dc56be346c4286a3b8d233158282843ccb5a45819764ad8124191b01cfe69125951b9dad17318fe43b2557cfc83ed7e22036
-
Filesize
793KB
MD5632b45bc3971a1d85d0f6288273f3574
SHA1b4e5474367d7a801c298d15c8c40e97890414329
SHA256ce32b04742ba33f6e2c0389160a6e1538322f0f6edeee04288bb4ca299d1b877
SHA512a48fa3d5cf8a201b6e63ac1081618b35bb858046741430cc73f112908eba3d5f085aed153907f45256d56f16245781c54bb72f69432fb49a544c7060772cc64d