7cf2788cdd29eea91f2772d7b8c24fb8fc68aa61b9625c10230571758a9eb583

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca0ff44f47b00dbfc080ae80e771dc22.exe
Size

247KB
MD5

ca0ff44f47b00dbfc080ae80e771dc22
SHA1

3c8fe64d5f205e455da73e2dfce9e3ed1de52bc7
SHA256

7cf2788cdd29eea91f2772d7b8c24fb8fc68aa61b9625c10230571758a9eb583
SHA512

c9d01e903d2455f616c991a03f4dfc760d2fbd854b78a0ab94d15277ac153766442cc286b8b19217cd9cb38b53b82f1ece6432effcae98dabf1f00a6d8ac8c67
SSDEEP

6144:SY94NATSZI1R1RzLXjP1HouXCEHujqpUu3wz:R9OAWGHLjjpou1HujqpZe

Score

7^/10

adware persistence stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	ca0ff44f47b00dbfc080ae80e771dc22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	rinst.exe

Executes dropped EXE 3 IoCs

pid	Process
1544	rinst.exe
2300	funny.exe
1712	bpk.exe

Loads dropped DLL 64 IoCs

pid	Process
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1400	explorer.exe
2216	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
2288	ca0ff44f47b00dbfc080ae80e771dc22.exe
3828	WerFault.exe
3828	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
1400	explorer.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
5108	WerFault.exe
1400	explorer.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1400	explorer.exe
3000	WerFault.exe
3000	WerFault.exe
3000	WerFault.exe
3000	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\explorer.exe"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bpk = "C:\\Windows\\SysWOW64\\bpk.exe"	bpk.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin"	bpk.exe

Modifies WinLogon 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\Logon = "WLELogon"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\StartScreenSaver = "WLEStartScreenSaver"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\Startup = "WLEStartup"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\Unlock = "WLEUnlock"	funny.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\Impersonate = "0"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\Logoff = "WLELogoff"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\DllName = "explorer.dll"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\StopScreenSaver = "WLEStopScreenSaver"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\Lock = "WLELock"	funny.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\Shutdown = "WLEShutdown"	funny.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	funny.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer	funny.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\explorer\Asynchronous = "0"	funny.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bpkhk.dll	rinst.exe
File created	C:\Windows\SysWOW64\bpkwb.dll	rinst.exe
File created	C:\Windows\SysWOW64\explorer.exe	funny.exe
File created	C:\Windows\SysWOW64\rinst.exe	rinst.exe
File opened for modification	C:\Windows\SysWOW64\pk.bin	bpk.exe
File created	C:\Windows\SysWOW64\pk.bin	rinst.exe
File created	C:\Windows\SysWOW64\bpk.exe	rinst.exe
File created	C:\Windows\SysWOW64\mc.dat	rinst.exe
File created	C:\Windows\SysWOW64\inst.dat	rinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2216	1400	WerFault.exe	95
3828	2216	WerFault.exe	99
5108	1400	WerFault.exe	95
1948	1400	WerFault.exe	95
3000	1400	WerFault.exe	95
1996	1400	WerFault.exe	95

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\Programmable	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\bpkwb.dll"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer\ = "PK.IE.1"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID\ = "PK.IE.1"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "IE Plugin Class"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bpk.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS\ = "0"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\ = "IE Class"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ = "C:\\Windows\\SysWow64\\bpkwb.dll"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID\ = "PK.IE"	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ThreadingModel = "Apartment"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0	bpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0"	bpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	bpk.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1712	bpk.exe
1712	bpk.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe
1712	bpk.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1544	2288	ca0ff44f47b00dbfc080ae80e771dc22.exe	90
PID 2288 wrote to memory of 1544	2288	ca0ff44f47b00dbfc080ae80e771dc22.exe	90
PID 2288 wrote to memory of 1544	2288	ca0ff44f47b00dbfc080ae80e771dc22.exe	90
PID 1544 wrote to memory of 2300	1544	rinst.exe	93
PID 1544 wrote to memory of 2300	1544	rinst.exe	93
PID 1544 wrote to memory of 2300	1544	rinst.exe	93
PID 1544 wrote to memory of 1712	1544	rinst.exe	94
PID 1544 wrote to memory of 1712	1544	rinst.exe	94
PID 1544 wrote to memory of 1712	1544	rinst.exe	94
PID 2300 wrote to memory of 1400	2300	funny.exe	95
PID 2300 wrote to memory of 1400	2300	funny.exe	95
PID 2300 wrote to memory of 1400	2300	funny.exe	95

C:\Users\Admin\AppData\Local\Temp\ca0ff44f47b00dbfc080ae80e771dc22.exe
"C:\Users\Admin\AppData\Local\Temp\ca0ff44f47b00dbfc080ae80e771dc22.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\funny.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\funny.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\system32\explorer.exe
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 888
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 500
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:3828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 880
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:5108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 896
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 900
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:3000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 876
        5⤵
        Program crash
        
        PID:1996
- - C:\Windows\SysWOW64\bpk.exe
    C:\Windows\system32\bpk.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2216 -ip 2216
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3828 -ip 3828
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3828 -ip 3828
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3828 -ip 3828
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3828 -ip 3828
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3828 -ip 3828
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3828 -ip 3828
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3828 -ip 3828
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3828 -ip 3828
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3828 -ip 3828
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3828 -ip 3828
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3828 -ip 3828
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3828 -ip 3828
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3828 -ip 3828
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2216 -ip 2216
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2216 -ip 2216
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2216 -ip 2216
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2216 -ip 2216
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2216 -ip 2216
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2216 -ip 2216
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2216 -ip 2216
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2216 -ip 2216
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2216 -ip 2216
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2216 -ip 2216
1⤵
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2216 -ip 2216
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2216 -ip 2216
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1400 -ip 1400
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5108 -ip 5108
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5108 -ip 5108
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5108 -ip 5108
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5108 -ip 5108
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5108 -ip 5108
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5108 -ip 5108
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5108 -ip 5108
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5108 -ip 5108
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5108 -ip 5108
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5108 -ip 5108
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5108 -ip 5108
1⤵
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5108 -ip 5108
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5108 -ip 5108
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1400 -ip 1400
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1948 -ip 1948
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1948 -ip 1948
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1948 -ip 1948
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1948 -ip 1948
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1948 -ip 1948
1⤵
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1948 -ip 1948
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1948 -ip 1948
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1948 -ip 1948
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1948 -ip 1948
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1948 -ip 1948
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1948 -ip 1948
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1948 -ip 1948
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1948 -ip 1948
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1400 -ip 1400
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3000 -ip 3000
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3000 -ip 3000
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3000 -ip 3000
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3000 -ip 3000
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3000 -ip 3000
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3000 -ip 3000
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3000 -ip 3000
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3000 -ip 3000
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3000 -ip 3000
1⤵
PID:708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3000 -ip 3000
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3000 -ip 3000
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3000 -ip 3000
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3000 -ip 3000
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1400 -ip 1400
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1996 -ip 1996
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1996 -ip 1996
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1996 -ip 1996
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1996 -ip 1996
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1996 -ip 1996
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1996 -ip 1996
1⤵
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1996 -ip 1996
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1996 -ip 1996
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1996 -ip 1996
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1996 -ip 1996
1⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1996 -ip 1996
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1996 -ip 1996
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1996 -ip 1996
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpk.exe

Filesize
392KB

MD5
4c6ba951dd8ed10304dbd862172642ed

SHA1
2eb2cbdb4f9dc994943b5a8acae81b4bca8f48c4

SHA256
67254c34cb745734d9dd199fd3aedf93caed61326b030a41277c3cd0ab74ecfe

SHA512
e3bba936583f35ad16c8d83b3f30cc2e9a5a55d4a32813db638a32ff281d5ed6b10cbab47ea5fa23f8f35d40f93c40f53b4c023ccfcd496c653155d88cb644f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkhk.dll

Filesize
8KB

MD5
bd253c4a5fccb829819eec341b7d7ecb

SHA1
72afa3d1caab1236222c16de1dc4fba5c9a1aa01

SHA256
cc724a23093bce21726ae090d8fff2a3f8c87914a2a90f713511e554aa758ba2

SHA512
54bb41abbdb7d86c7d887c8c44d33b95b40044e6b633cbeeb70bf62f97d1be762163a83f91300ee7a8339b3b0af5cc2fd465d22438c2ac27a2f001f75fdc2aa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkwb.dll

Filesize
40KB

MD5
6eb5b9a72e963d47aa905ff42ec20227

SHA1
9b04d95e50323f84e4ea203a70558fc9e35ae0d8

SHA256
87feeaee64959dbc5e84a7ccf9aa2bca22b46bea3da91d5fbe5bcbfd6130ea86

SHA512
7db7b7377548b517a9835f8f94f64fbdcb75c83ed5afbabf153bc9acca01b534b332f43b5fc726fb728dadaa86ef9cff1af01c4d26d4a3f5903cbb11cdd0a76f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\funny.exe

Filesize
43KB

MD5
1b26bda9bb20e5bc9f128c39c6f0318f

SHA1
0acdd1c4fde78dc5c139ea72933aebe524392325

SHA256
338a76a9a4070e756cb8b4626da8e40921bd44c620f053795539b28bb2472cc3

SHA512
11a98b61e098917ea50c34cc3bcb1bd403e8d9429dffcc779378e7d44c307298dc031f8d127e5a4a8aa8da7d44b8e66b4735c3ea7260ff49ddaed8422c66d0c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat

Filesize
996B

MD5
8a3d63d72ff9c02e5fafd0f750d77062

SHA1
45ca88de288af6433f131b3a4c7b67a481280191

SHA256
e55e23832e295be70eec2996297f76271af6ca709836c5be0cd574b63357c4cb

SHA512
4023ea55c3c4beb09d4f0984c47b9bb2d648ddfd6aa70fa1ab88af9b46b805c7d0f41b0e38e3edd5f032ffc7f5235483eb8c3c52d269f9a37dd40c897c9d7880

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mc.dat

Filesize
29B

MD5
ca3531ec1f25b4724f62e707341890a2

SHA1
62cce3c72a29ec629c8138f26e299645d106e404

SHA256
ca602ecac6c055060be8fa1aa5750d37c504e5b29ccfd518498b1d442e98ae59

SHA512
5e5b3bd61715ba83f4d7c8e1779e66095914866635377f6ab4084a217227f196b00511d32ad5a40402429430ea031b2bf43dec9d953e1050558618a9f30a47f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin

Filesize
3KB

MD5
b4f7aa250616a87114907e9ebd5e98da

SHA1
f29474ba5dd78069312614627ead22614776c674

SHA256
c48484da45fd85d8144ad3484b95b7e898d1a838ac6dd1f0b2e8ca6ce35e1c62

SHA512
8115f42dec8caca609e776cc0a98fd5fc9fa579ec9af36fa4470a46c3e10add5944a5edd31b3d720cc4bbdad082257cf812f72a9d6751aabfeaf6f7c62fb6907

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe

Filesize
7KB

MD5
a09df00f1dee720c69dd28459b5c764c

SHA1
80bf56dd1fcb8bd88eaf62019cb9777dba1fd043

SHA256
0fdcf4d3a9ee72b58080c34d63ffc9e41acf0d5e3f82d9434da3e48794f8f39b

SHA512
52e0ac7936faba8cc5e63863f6eb1e4e47e555fbdb64cf48d87fa061cabba6f595f54a3b3d9b21ed8bdc0f36d2e29b986ed5f3b20ee221d90961bd76a2f7baa6

Download Submit
C:\Windows\SysWOW64\bpk.exe

Filesize
392KB

MD5
18bc32bb8a8d5a85cdafad5a4ecc4c73

SHA1
31b65276e08f95ae14fd15774e563e331ddd7ce3

SHA256
1f24774151bb2b161aee3b68dc10b935fd870a911ea8393c7bb35e34e28c57fd

SHA512
d13636532b25d33602c2c031b9479d6b1cf4baae58994a8933ab2d160337a5539f975ece4f93de2d069388af1791ee04027a0405ee18d4e3e6c5c5232094eb36

Download Submit
C:\Windows\SysWOW64\bpkhk.dll

Filesize
8KB

MD5
a51cd9899672b880685b216c4fa9b099

SHA1
10167db3dfd91f3b47b37b6e0f6578fa80e1d2f4

SHA256
9c5c2ec857c02cf321f6a9adfc68fb771a4c058dea8287d5dff6b40ee2a6ab54

SHA512
921ccedb689a89f9a74c4ee9d78fa38409d3dd47cd2c3949a795b41902774ae08371b71d3291e142c76b8dc952f91386f7ef6247e1faf004c5078675657c33fa

Download Submit
C:\Windows\SysWOW64\bpkwb.dll

Filesize
40KB

MD5
1a552164764b4c75b78202e32cc8821e

SHA1
bd2b63665f774fe1a39f4d70213f03fdb1653e55

SHA256
9d71699c2903cd94d6152f10cd733b676579150adc3eb87b048f48b0e77bdf7c

SHA512
1a4ce157dc994f8ef1953a21ad1638b5bf44cc52727dd6765110af5cd204e9dfafa6fa897fc8b46eb1a2307432d87009b7f1e0c8af0aa684eff134c278bef209

Download Submit
C:\Windows\SysWOW64\mc.dat

Filesize
29B

MD5
53386e1ecce2875ab3ff6369efed53b9

SHA1
defe928d6b94ee3f465ba5d6e5147600e783a1a1

SHA256
58f989dc5a0659d8e54b39d25bb345d77cf2ab5eb11d4ce5f0766052a2d9cbd8

SHA512
ad62c44a67ec881467ffebad368ca2ff0f5749a3b23a2d82182c5e22bfa050c4a492b9febb47bbad5a78fe94ab1eda9b930b7cd68ed917ae9f23cfba949e823c

Download Submit
C:\Windows\SysWOW64\pk.bin

Filesize
3KB

MD5
c48308211a425a4eb41ea5b5ded6bd49

SHA1
95a0cbce0da0b11bce006264d41ed9ac613166fa

SHA256
9957d4e26237dd57218379654170332d95a882c2fa128a7d878e0578b1be8399

SHA512
1f804a1f06bce628000808511b1179219b9652300252d2a6d754e49864ef00b379c36212b94d65f311623654e6232059b6c27fae4f07915cd03cbdcda3f5531d

Download Submit
memory/2288-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2288-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2288-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2288-83-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads