b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

General

Target

authroot.stl
Size

175KB
MD5

dd73cead4b93366cf3465c8cd32e2796
SHA1

74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256

a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512

ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
SSDEEP

1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 15 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\怰㾣ˢ\ = "stl_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\stl_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\stl_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\.stl	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\stl_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\stl_auto_file\shell\Read\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\瘟ᚿ㔀蠀\ = "stl_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\stl_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\.stl\ = "stl_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\赴翼	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\赴翼\ = "stl_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\怰㾣ˢ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\瘟ᚿ㔀蠀	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

4924 OpenWith.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

OpenWith.exeAcroRd32.exe

pid	process
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
1960	AcroRd32.exe
1960	AcroRd32.exe
1960	AcroRd32.exe
1960	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OpenWith.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4924 wrote to memory of 1960	4924	OpenWith.exe	AcroRd32.exe
PID 4924 wrote to memory of 1960	4924	OpenWith.exe	AcroRd32.exe
PID 4924 wrote to memory of 1960	4924	OpenWith.exe	AcroRd32.exe
PID 1960 wrote to memory of 1280	1960	AcroRd32.exe	RdrCEF.exe
PID 1960 wrote to memory of 1280	1960	AcroRd32.exe	RdrCEF.exe
PID 1960 wrote to memory of 1280	1960	AcroRd32.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 1940	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe
PID 1280 wrote to memory of 4304	1280	RdrCEF.exe	RdrCEF.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\authroot.stl
1⤵
- Modifies registry class
PID:4512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\authroot.stl"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=92FBBF83F47CF8F53D7CAFC46A12CACC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=92FBBF83F47CF8F53D7CAFC46A12CACC --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A0F230B4752D70A2D280D900A461BA3B --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads