f86610b9d5850ca73c582555f5083c6353ddc81fd6878d15dedb0a9bc42e0bf2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c79bc21854940f8d1a1248205508fb57.exe
Size

72KB
MD5

c79bc21854940f8d1a1248205508fb57
SHA1

0b70537a8af1909510ae5bb0fa4e0bb93772e2ad
SHA256

f86610b9d5850ca73c582555f5083c6353ddc81fd6878d15dedb0a9bc42e0bf2
SHA512

805f56a27b861d2c78b34424316fd53ef59c096a9701ce232827920831831a903ef1870459fa400326b1e57259e770ac412909ca6650d0fafe5e0ec4897f77bb
SSDEEP

1536:5LXB65939tY6HBg4sXJdYiurLQcsUuf91L:5Lk395hYXJdzILSf9R

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2796	c79bc21854940f8d1a1248205508fb57.exe
2796	c79bc21854940f8d1a1248205508fb57.exe
2796	c79bc21854940f8d1a1248205508fb57.exe
2796	c79bc21854940f8d1a1248205508fb57.exe
2796	c79bc21854940f8d1a1248205508fb57.exe
2796	c79bc21854940f8d1a1248205508fb57.exe
2796	c79bc21854940f8d1a1248205508fb57.exe
2796	c79bc21854940f8d1a1248205508fb57.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\LocalizedString = "@shdoclc.dll,-880"	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\´ò¿ªÖ÷Ò³(&H)	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\´ò¿ªÖ÷Ò³(&H)\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.3932.com/?c"	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\Shell\ÊôÐÔ(&R)	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder\HideFolderVerbs	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder\HideOnDesktopPerUser	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\DefaultIcon	c79bc21854940f8d1a1248205508fb57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder\Attributes = "0"	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\DefaultIcon\ = "shdoclc.dll,0"	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\InProcServer32\ThreadingModel = "Apartment"	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\ÊôÐÔ(&R)\ = "ÊôÐÔ(&R)"	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shdocvw.dll"	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\´ò¿ªÖ÷Ò³(&H)\MUIVerb = "@shdoclc.dll,-10241"	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\ÊôÐÔ(&R)\Command	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\´ò¿ªÖ÷Ò³(&H)\Command	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\ÊôÐÔ(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\InProcServer32	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\ = "´ò¿ªÖ÷Ò³(&H)"	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\shell\´ò¿ªÖ÷Ò³(&H)\ = "´ò¿ªÖ÷Ò³(&H)"	c79bc21854940f8d1a1248205508fb57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E456F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder\WantsParsDisplayName	c79bc21854940f8d1a1248205508fb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	c79bc21854940f8d1a1248205508fb57.exe

C:\Users\Admin\AppData\Local\Temp\c79bc21854940f8d1a1248205508fb57.exe
"C:\Users\Admin\AppData\Local\Temp\c79bc21854940f8d1a1248205508fb57.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg3C8D.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg3C8D.tmp\registry.dll

Filesize
16KB

MD5
24a7a119e289f1b5b69f3d6cf258db7c

SHA1
fec84298f9819adf155fcf4e9e57dd402636c177

SHA256
ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1

SHA512
fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861

Download Submit