Analysis
-
max time kernel
91s -
max time network
98s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
15-04-2024 13:39
General
-
Target
OfflineRegistrator.exe
-
Size
6.6MB
-
MD5
a22bd669a03540455a051fc21bd6aac3
-
SHA1
a39988a668707ab0540b08b4155591a8bbed1491
-
SHA256
d0573fc105d41e02984df43592f2a5c6f496597b58e0ff5653bba407c198bb34
-
SHA512
d6401469ffa17a03aef7323bf6ad4ed97638f2da61f91098e2cb80c9cd86ac2d1f4cc0d51c3004bf18568e7cd81f95799eb60a4c2e25ed6f413b08694d0520a8
-
SSDEEP
196608:wCK9wXYp3E0fqcof+gSCU3OUyrpcZReoMPix4wygrN9xCt3Y6x:Tkw+qff4lO1cZReoMPiTNCZ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfflineRegistrator.exe"C:\Users\Admin\AppData\Local\Temp\OfflineRegistrator.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s FDResPub1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\SplitEnter.xlt"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5d03385b749f79412bd1a96c28eebdd20
SHA1da0beef647cb6f268c76bced218c9e4367432e21
SHA2561ee1e8f8e279f38c81a566cc3b9e93206367ca91e74f4018e3735eb9b3a58759
SHA512d9bb49224635a7baa5702913961a0b2279e0dff3c64c8c9b3bed43c87a449808b325141298eb64efeebd8f8a4478f9ca89bf831d5239ff8325000e809a744cf7
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
756KB