3f8bb05ab31da10400481698b66072089ff6963dd3675c24bf91cc7ba990b774

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbff85f6f1ac34390b4683df700f2815.exe
Size 303KB
Sample240309-re689aac5s
SHA256 3f8bb05ab31da10400481698b66072089ff6963dd3675c24bf91cc7ba990b774
MD5 bbff85f6f1ac34390b4683df700f2815
SHA1 f7a4b8d4ccb4fe0762c5ddc5dc0b01838996d567
SHA512 4a80c43fb8ecc133abf26ceae2b9c189d04c5cd6768d81db580ba3de7915e5f3cfe923e88bc5dc99489269410e944d98ec2f8ad4180982735de195625dcc4422
SSDEEP 6144:7In3U0sdqzJNI+GJemdIwArN/oNiOyow33gOQv5DhN/x56s:iE0shlJemdirN/oFyoq3Qv5D/Z
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery persistence stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	bbff85f6f1ac34390b4683df700f2815.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	temp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	istinstall.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	temp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	kimochiz.exe

Executes dropped EXE 15 IoCs

pid	Process
4212	mss.exe
832	kimochiz.exe
2272	istinstall.exe
3376	temp.exe
4444	setup32.exe
3572	temp.exe
4396	setup32.exe
3880	setup32.exe
2404	setup32.exe
4876	setup32.exe
4228	setup32.exe
1076	setup32.exe
2824	setup32.exe
4280	setup32.exe
1420	setup32.exe

Loads dropped DLL 2 IoCs

pid	Process
3376	temp.exe
3572	temp.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023266-25.dat	upx
behavioral2/memory/2272-34-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2272-86-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kimochiz.exe = "C:\\Windows\\temp\\kimochiz.exe"	bbff85f6f1ac34390b4683df700f2815.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\istinstall.exe = "C:\\Windows\\temp\\istinstall.exe"	bbff85f6f1ac34390b4683df700f2815.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	temp.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	temp.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	mss.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	mss.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File opened for modification	C:\Windows\SysWOW64\setup32.exe	setup32.exe
File created	C:\Windows\SysWOW64\setup32.exe	setup32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	temp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{825CF5BD-8862-4430-B771-0C15C5CA8DEF} = "EliteToolBar"	temp.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{825CF5BD-8862-4430-B771-0C15C5CA8DEF} = 00	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	temp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{825CF5BD-8862-4430-B771-0C15C5CA8DEF} = "EliteToolBar"	temp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	kimochiz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	kimochiz.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{825CF5BD-8862-4430-B771-0C15C5CA8DEF} = 00	regedit.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32\ = "C:\\Windows\\EliteToolBar\\EliteToolBar version 60.dll"	temp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	temp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32	temp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32\ThreadingModel = "Apartment"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32\ = "C:\\Windows\\EliteToolBar\\EliteToolBar version 60.dll"	temp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32	temp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\Programmable	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	temp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32\ = "C:\\Windows\\EliteToolBar\\EliteToolBar version 60.dll"	temp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32	temp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\ = "&EliteBar"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\Programmable	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32\ThreadingModel = "Apartment"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	temp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\ = "&EliteBar"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\ = "&EliteBar"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}	temp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32\ThreadingModel = "Apartment"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32	temp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32\ = "C:\\Windows\\EliteToolBar\\EliteToolBar version 60.dll"	temp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32\ThreadingModel = "Apartment"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\ = "&EliteBar"	regedit.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2600	regedit.exe
1548	regedit.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4212	876	bbff85f6f1ac34390b4683df700f2815.exe	89
PID 876 wrote to memory of 4212	876	bbff85f6f1ac34390b4683df700f2815.exe	89
PID 876 wrote to memory of 4212	876	bbff85f6f1ac34390b4683df700f2815.exe	89
PID 876 wrote to memory of 832	876	bbff85f6f1ac34390b4683df700f2815.exe	90
PID 876 wrote to memory of 832	876	bbff85f6f1ac34390b4683df700f2815.exe	90
PID 876 wrote to memory of 832	876	bbff85f6f1ac34390b4683df700f2815.exe	90
PID 876 wrote to memory of 2272	876	bbff85f6f1ac34390b4683df700f2815.exe	91
PID 876 wrote to memory of 2272	876	bbff85f6f1ac34390b4683df700f2815.exe	91
PID 876 wrote to memory of 2272	876	bbff85f6f1ac34390b4683df700f2815.exe	91
PID 832 wrote to memory of 3376	832	kimochiz.exe	92
PID 832 wrote to memory of 3376	832	kimochiz.exe	92
PID 832 wrote to memory of 3376	832	kimochiz.exe	92
PID 3376 wrote to memory of 1548	3376	temp.exe	93
PID 3376 wrote to memory of 1548	3376	temp.exe	93
PID 3376 wrote to memory of 1548	3376	temp.exe	93
PID 4212 wrote to memory of 4444	4212	mss.exe	94
PID 4212 wrote to memory of 4444	4212	mss.exe	94
PID 4212 wrote to memory of 4444	4212	mss.exe	94
PID 3376 wrote to memory of 1132	3376	temp.exe	96
PID 3376 wrote to memory of 1132	3376	temp.exe	96
PID 3376 wrote to memory of 1132	3376	temp.exe	96
PID 832 wrote to memory of 3572	832	kimochiz.exe	97
PID 832 wrote to memory of 3572	832	kimochiz.exe	97
PID 832 wrote to memory of 3572	832	kimochiz.exe	97
PID 3572 wrote to memory of 2600	3572	temp.exe	99
PID 3572 wrote to memory of 2600	3572	temp.exe	99
PID 3572 wrote to memory of 2600	3572	temp.exe	99
PID 3572 wrote to memory of 4876	3572	temp.exe	102
PID 3572 wrote to memory of 4876	3572	temp.exe	102
PID 3572 wrote to memory of 4876	3572	temp.exe	102
PID 832 wrote to memory of 4456	832	kimochiz.exe	104
PID 832 wrote to memory of 4456	832	kimochiz.exe	104
PID 832 wrote to memory of 4456	832	kimochiz.exe	104
PID 4444 wrote to memory of 4396	4444	setup32.exe	111
PID 4444 wrote to memory of 4396	4444	setup32.exe	111
PID 4444 wrote to memory of 4396	4444	setup32.exe	111
PID 4396 wrote to memory of 3880	4396	setup32.exe	115
PID 4396 wrote to memory of 3880	4396	setup32.exe	115
PID 4396 wrote to memory of 3880	4396	setup32.exe	115
PID 3880 wrote to memory of 2404	3880	setup32.exe	123
PID 3880 wrote to memory of 2404	3880	setup32.exe	123
PID 3880 wrote to memory of 2404	3880	setup32.exe	123
PID 2404 wrote to memory of 4876	2404	setup32.exe	124
PID 2404 wrote to memory of 4876	2404	setup32.exe	124
PID 2404 wrote to memory of 4876	2404	setup32.exe	124
PID 4876 wrote to memory of 4228	4876	setup32.exe	125
PID 4876 wrote to memory of 4228	4876	setup32.exe	125
PID 4876 wrote to memory of 4228	4876	setup32.exe	125
PID 4228 wrote to memory of 1076	4228	setup32.exe	127
PID 4228 wrote to memory of 1076	4228	setup32.exe	127
PID 4228 wrote to memory of 1076	4228	setup32.exe	127
PID 1076 wrote to memory of 2824	1076	setup32.exe	128
PID 1076 wrote to memory of 2824	1076	setup32.exe	128
PID 1076 wrote to memory of 2824	1076	setup32.exe	128
PID 2824 wrote to memory of 4280	2824	setup32.exe	129
PID 2824 wrote to memory of 4280	2824	setup32.exe	129
PID 2824 wrote to memory of 4280	2824	setup32.exe	129
PID 4280 wrote to memory of 1420	4280	setup32.exe	130
PID 4280 wrote to memory of 1420	4280	setup32.exe	130
PID 4280 wrote to memory of 1420	4280	setup32.exe	130

C:\Users\Admin\AppData\Local\Temp\bbff85f6f1ac34390b4683df700f2815.exe
"C:\Users\Admin\AppData\Local\Temp\bbff85f6f1ac34390b4683df700f2815.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\temp\mss.exe
  "C:\Windows\temp\mss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\setup32.exe
    C:\Windows\system32\setup32.exe 1192 "C:\Windows\temp\mss.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\setup32.exe
      C:\Windows\system32\setup32.exe 1148 "C:\Windows\SysWOW64\setup32.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\SysWOW64\setup32.exe
        
        C:\Windows\system32\setup32.exe 1120 "C:\Windows\SysWOW64\setup32.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3880
      - C:\Windows\SysWOW64\setup32.exe
        
        C:\Windows\system32\setup32.exe 1128 "C:\Windows\SysWOW64\setup32.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\setup32.exe
        
        C:\Windows\system32\setup32.exe 1124 "C:\Windows\SysWOW64\setup32.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\setup32.exe
        
        C:\Windows\system32\setup32.exe 1132 "C:\Windows\SysWOW64\setup32.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\setup32.exe
        
        C:\Windows\system32\setup32.exe 1036 "C:\Windows\SysWOW64\setup32.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\SysWOW64\setup32.exe
        
        C:\Windows\system32\setup32.exe 1144 "C:\Windows\SysWOW64\setup32.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\setup32.exe
        
        C:\Windows\system32\setup32.exe 1156 "C:\Windows\SysWOW64\setup32.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\setup32.exe
        
        C:\Windows\system32\setup32.exe 1152 "C:\Windows\SysWOW64\setup32.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1420
- C:\Windows\temp\kimochiz.exe
  "C:\Windows\temp\kimochiz.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:832
- - \??\c:\temp.exe
    c:\temp.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s /c "C:\Users\Admin\AppData\Local\Temp\\install.reg"
      4⤵
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      Runs .reg file with regedit
      PID:1548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\temp.bat" "
      4⤵
      PID:1132
- - \??\c:\temp.exe
    c:\temp.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s /c "C:\Users\Admin\AppData\Local\Temp\\install.reg"
      4⤵
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      Runs .reg file with regedit
      PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\temp.bat" "
      4⤵
      PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\temp.bat" "
    3⤵
    PID:4456
- C:\Windows\temp\istinstall.exe
  "C:\Windows\temp\istinstall.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fgkvFgC.exe

Path C:\Users\Admin\AppData\Local\Temp\fgkvFgC.exe
Size 315B
SHA256 a2e75a8eb5c364d4e2fc55d8bc0bd0b0ef84f6b80dec9d7e4d243c0ae9a5c25a
MD5 6715f439f4e0b5c1915bf471e769419f
SHA1 f1d686628744ed9dbd3c7e556feceecc2e955b96
SHA512 cf71ca65d6979752c21ea7dbbab7b94b1b0294952d3c9d259f4287ab159926ac2b00aca3055608f7c5a38aa910140394a7e0f2c06d621d05f9e003b90ee7a302
MD5 SHA1 SHA512

Submit Download

install.reg

Path C:\Users\Admin\AppData\Local\Temp\install.reg
Size 1KB
SHA256 cffe1b841b61695e850c03e9545694ec251ea8d842fdf138df07ea903a5ad930
MD5 94c686db0514b128387c1bcfcfdc48cd
SHA1 e9dd82395df68d5f8b2e17fc17034dde93232582
SHA512 7b24478d6079d80a8193e8e2532cf00f65a0ff4355753f62e902ab7dff19b15599ba98df41c0f0cefbe9a8247f86b581c2b1b82d0c043e66d36eac7a5b6d5f1c
MD5 SHA1 SHA512

Submit Download

EliteToolBar version 60.dll

Path C:\Windows\EliteToolBar\EliteToolBar version 60.dll
Size 95KB
SHA256 3dd3cd348c3b74135c609c90328eed023d0d7951e91357ebcf585bb4ecc45cc8
MD5 4820e63ac6f0b98234d559cf365c53af
SHA1 100dcd0180521485356e5f633cba94aabd7d2600
SHA512 c621b4ca605c4502b1822d28f87303ccdb46a61f9a37e0bdd7620d0d626e6a0ed46bcc210c391fb7e43c1e180456d7b05440c14d0262de7745c7d8cfef96647a
SSDEEP 1536:w3dVnIFW/r5Dt5hXA7Hx9rhkdVH2cFyFZZZTfDp7wAw6BzwQ2+PIVJ9jDIR:wtFIFyDlQ7HxBGucFYZ/zDhw6BEQ2+PG
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup32.exe

Path C:\Windows\SysWOW64\setup32.exe
Size 98KB
SHA256 b4298038f799cfa397a353e569adcdf123084db0e45d2ccaa10bcde08481a2ef
MD5 3e381e696e28a8d792168393242bf10e
SHA1 1f0f3dfde52a11d0bd7ca5e1f69a79ba0f464777
SHA512 e4b1bbc0c7dba4bbdea51b2715c90280ad2e20df37d8adaf5150ec6291bc350db494e77bcec7a76ab5694db3e06c890e99dca25a05c4a8c6811c5809757092cf
SSDEEP 1536:p4m1rymiyngOWUsnBa+8XYRl2kX80MwWaQ9n5pZ/7h+VQjMC4p4d3Z:pNZiVXUsnBp8IRNbhWJt5pWVQjfdp
MD5 SHA1 SHA512 SSDEEP

Submit Download

istinstall.exe

Path C:\Windows\Temp\istinstall.exe
Size 4KB
SHA256 4b716a1486f126f6b2ef33ffd6c44cc427ffdca3ab584b8b3382ebe2e18e8684
MD5 35a32045c2620f1f8bca6f3a4891c8e3
SHA1 fe0290889daf10533ef487289bd9a6394e491d24
SHA512 ca9967f8ef986def31c75eaba4d19620982d27b0b71988c46c7826e8e32baf956d518d18c47d71d8ec8e7e1340036d7ef4978c140ae80acd589fd4f6948a92a5
SSDEEP 48:CGAH8C9VxG8rCpC9Y4Uzm1uBb8b8kyoPpSi3PLsXd7/HZZuW04SeJY8JTaoTZrQB:kceVrr2C9YRl53oBSi3PLsXdzHTu7WS
MD5 SHA1 SHA512 SSDEEP

Submit Download

kimochiz.exe

Path C:\Windows\Temp\kimochiz.exe
Size 148KB
SHA256 a76ebe06baa89661c87e40a3a04ed87d043011443e0e3db122ca932d58842c43
MD5 8dfbc2ae61e36b41e6c8639f258cdf30
SHA1 46cc46d4dc0a8b1e192626aca53dd0af8e75c3f8
SHA512 3067d6db58d32f379a36b755a37f9ce9dcfc7d49161af1977308043c43fd7237f4a81eb4d9cd4241e80d304d2060e3d85879cbe1cce28c11148bd38f5dce6882
SSDEEP 3072:boCN48WQtFIFyDlQ7HxBGucFYZ/zDhw6BEQ2+PIFDfKO:Ba8RFQNQ7uLNw6CcQVKO
MD5 SHA1 SHA512 SSDEEP

Submit Download

mss.exe

Path C:\Windows\Temp\mss.exe
Size 168KB
SHA256 14c3a2b88f274afb867df69553956bf8affb761fa6618778087c86fd7c603a0e
MD5 a4a23feebba7120c57e86fa8c7c19e89
SHA1 a385d4c1a4631bac07114de7d081d88e28709522
SHA512 3631a9b9fa3c10ed7d8578287237a44cecd3a2a6e60d9b71a42d45e81ec0eb350f2068e95134342854a8065a6a922c86c44b7977a1f8d0f7a64bb6428fea0d65
SSDEEP 3072:pNZiVXUsnBp8IRNbhWJt5pWVQjfd2Jj0hUYpQaeTcUydyjn/QXm8nznFNnunpnem:fZ6xnBSIRN1+t5pWQwcccUg6Q2YcR
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.bat

Path C:\temp.bat
Size 83B
SHA256 759c0cc9683a423547ff7faef505e88b222f7134d2e773d840ccd9027ea98b76
MD5 2a95cfba05d06df50e81fb1e01ceb601
SHA1 3ee97499dbfb3c84be154375b1c42874eaa9bbdf
SHA512 24f0e5182f77a33f99ae2428e75fe384469a871a39c7bf1b5338a8303ad684b6c56177611135f4741fd06d675a164c22c2adb167941fac8243917d703f454371
MD5 SHA1 SHA512

Submit Download

temp.bat

Path C:\temp.bat
Size 117B
SHA256 57296d42b65cad2ac947db8e6578aa402fa3cac4afc30e34df50c824b7e49eb9
MD5 e14d23fff4c10dea7cff550f6f59b34b
SHA1 0a68cca6034cb3065f05828c1e6fe9e43128a089
SHA512 1c4b86363809d14da7f11f9570632de5c5af53750df36c2a04845989585c2d6623eb81a39c9e14a3c68928c3aef77f238f11a8ec294cf506c69239ba94af3443
MD5 SHA1 SHA512

Submit Download

temp.exe

Path C:\temp.exe
Size 112KB
SHA256 6e94af89cc4fc3b6d8c459ef3717a81d5332d7a9c1a8320a1ca1c91427dca010
MD5 d10fdaa95a76a5d35f9c2c7399b94ab6
SHA1 3c09c7f9ae79ecc270550a5945ae84f4e4f44f40
SHA512 3e726d6f99128307f994d71f65d800fd752ad5308c440166804cf0a5b63d59ac8e997908ae32f3dada62625b44aa1ef7511dc8e5152338b18c4f60517062daf8
SSDEEP 3072:w8WQtFIFyDlQ7HxBGucFYZ/zDhw6BEQ2+PIFD:w8RFQNQ7uLNw6CcQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/876-32-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1076-110-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/2272-34-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2272-86-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2404-100-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/2404-98-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/2824-113-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/3376-58-0x0000000010000000-0x0000000010149000-memory.dmp

Download

memory/3376-44-0x0000000002080000-0x0000000002081000-memory.dmp

Download

memory/3376-43-0x0000000010000000-0x0000000010149000-memory.dmp

Download

memory/3572-65-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/3572-64-0x0000000010000000-0x0000000010149000-memory.dmp

Download

memory/3572-87-0x0000000010000000-0x0000000010149000-memory.dmp

Download

memory/3880-96-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4212-9-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4212-53-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4228-105-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4228-107-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4280-116-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4396-93-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4444-90-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4444-51-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4876-103-0x0000000000400000-0x000000000054C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads