9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7

General

Target
9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Size 214KB
Sample240404-21dh6sch2x
SHA256 9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7
MD5 28903409be4a183fc4970238d695e76d
SHA1 b354d82e073c5e296881301337047ed7a899a7d9
SHA512 5364364c68c41ab1c27c3da18bcb89f51d6210df7301c1c6f9ab8e56ca96bfdf09d1a0847780a34b6571e0d4c0973a1284b6d6d3064824557e2e416749604867
SSDEEP 3072:KhS7VD4/EnzzMUD8u8EC45xRS5b7lIf3GYHfqR1hAtTD5DyXglREK0c:dOizzb8uDxZCHlIZgEh5DyXglh
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000002324e-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4104-18-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000800000002324e-10.dat	aspack_v212_v242

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\QFYVC.EXE \"%1\" %*"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QFYVC.EXE = "C:\\Program Files (x86)\\QFYVC.EXE"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\I:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\K:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\M:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\Q:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\R:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\S:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\J:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\L:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\O:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\V:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\E:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\G:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\H:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\N:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\P:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\T:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\QFYVC.EXE	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened for modification	C:\Program Files (x86)\QFYVC.EXE	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\$Recycle.Bin\\FCX.EXE %1"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\QFYVC.EXE \"%1\" %*"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\$Recycle.Bin\\FCX.EXE \"%1\""	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\$Recycle.Bin\\FCX.EXE %1"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\$Recycle.Bin\\FCX.EXE \"%1\""	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

C:\Users\Admin\AppData\Local\Temp\9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
"C:\Users\Admin\AppData\Local\Temp\9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FCX.EXE

Path C:\$Recycle.Bin\FCX.EXE
Size 214KB
SHA256 d9c875f899d4fd84f045cf516be1db87f805ca3e4674a6dad91fa07792396d13
MD5 706837b86a84185849800c511da2fae2
SHA1 d595f9e48838f0df99cfb8978a7d3e3dd1d93673
SHA512 4b70e2620e5803672848e0b25a49e8beb49424d89bad4d6db9c1b0764d02380f406970d77c539a2d1009455d71f095b46708182ebbb68920d6e5976669f5e490
SSDEEP 3072:KhS7VD4/EnzzMUD8u8EC45xRS5b7lIf3GYHfqR1hAtTD5DyXglREK0c:dOizzb8uDxZCHlIZgEh5DyXglh
MD5 SHA1 SHA512 SSDEEP

Submit Download

filedebug

Path C:\filedebug
Size 258B
SHA256 bf5c4d2311d3feee29a13bf35ca46312c2f02a19b805169325e97908461c4f1f
MD5 3525a1ef8a8c8ebe7536e209f32597db
SHA1 2980e3902404d2356d64ae152a13a90b885d99ae
SHA512 9a2c0695eb4f4ac02c16a431afdc86735fbbab487d3e03b97c6f037c1341487daffb2beb019c5dbc01e376aabf67a2895b484c57c916c135998209df359052ec
MD5 SHA1 SHA512

Submit Download

memory/4104-0-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/4104-18-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads