fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Size 467KB
Sample240416-ebjmkaaf2t
SHA256 fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583
MD5 ed00e3d17a9bfc795a59462cc7126dfd
SHA1 c6c985668ff2555d9b9e96aa661424fff60aa07a
SHA512 d80ed7e9f94437a2cd8e6f716c18b782950c1efc3a057cbc9203868b601442ebf200ca36e5091e3b39d88465600998765356280c3e3770fa3b5641281166c2e3
SSDEEP 12288:9PcuNtL2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:RtL2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Delnin32.exe

Executes dropped EXE 12 IoCs

pid	Process
3216	Cfdhkhjj.exe
3388	Ceehho32.exe
2108	Cjbpaf32.exe
4956	Calhnpgn.exe
1540	Dopigd32.exe
4004	Dfknkg32.exe
4828	Dobfld32.exe
1700	Delnin32.exe
4844	Dfnjafap.exe
3256	Deagdn32.exe
2300	Dgbdlf32.exe
3600	Dmllipeg.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Jekpanpa.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	3600	WerFault.exe	100

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3216	2956	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe	89
PID 2956 wrote to memory of 3216	2956	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe	89
PID 2956 wrote to memory of 3216	2956	fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe	89
PID 3216 wrote to memory of 3388	3216	Cfdhkhjj.exe	90
PID 3216 wrote to memory of 3388	3216	Cfdhkhjj.exe	90
PID 3216 wrote to memory of 3388	3216	Cfdhkhjj.exe	90
PID 3388 wrote to memory of 2108	3388	Ceehho32.exe	91
PID 3388 wrote to memory of 2108	3388	Ceehho32.exe	91
PID 3388 wrote to memory of 2108	3388	Ceehho32.exe	91
PID 2108 wrote to memory of 4956	2108	Cjbpaf32.exe	92
PID 2108 wrote to memory of 4956	2108	Cjbpaf32.exe	92
PID 2108 wrote to memory of 4956	2108	Cjbpaf32.exe	92
PID 4956 wrote to memory of 1540	4956	Calhnpgn.exe	93
PID 4956 wrote to memory of 1540	4956	Calhnpgn.exe	93
PID 4956 wrote to memory of 1540	4956	Calhnpgn.exe	93
PID 1540 wrote to memory of 4004	1540	Dopigd32.exe	94
PID 1540 wrote to memory of 4004	1540	Dopigd32.exe	94
PID 1540 wrote to memory of 4004	1540	Dopigd32.exe	94
PID 4004 wrote to memory of 4828	4004	Dfknkg32.exe	95
PID 4004 wrote to memory of 4828	4004	Dfknkg32.exe	95
PID 4004 wrote to memory of 4828	4004	Dfknkg32.exe	95
PID 4828 wrote to memory of 1700	4828	Dobfld32.exe	96
PID 4828 wrote to memory of 1700	4828	Dobfld32.exe	96
PID 4828 wrote to memory of 1700	4828	Dobfld32.exe	96
PID 1700 wrote to memory of 4844	1700	Delnin32.exe	97
PID 1700 wrote to memory of 4844	1700	Delnin32.exe	97
PID 1700 wrote to memory of 4844	1700	Delnin32.exe	97
PID 4844 wrote to memory of 3256	4844	Dfnjafap.exe	98
PID 4844 wrote to memory of 3256	4844	Dfnjafap.exe	98
PID 4844 wrote to memory of 3256	4844	Dfnjafap.exe	98
PID 3256 wrote to memory of 2300	3256	Deagdn32.exe	99
PID 3256 wrote to memory of 2300	3256	Deagdn32.exe	99
PID 3256 wrote to memory of 2300	3256	Deagdn32.exe	99
PID 2300 wrote to memory of 3600	2300	Dgbdlf32.exe	100
PID 2300 wrote to memory of 3600	2300	Dgbdlf32.exe	100
PID 2300 wrote to memory of 3600	2300	Dgbdlf32.exe	100

C:\Users\Admin\AppData\Local\Temp\fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe
"C:\Users\Admin\AppData\Local\Temp\fbfd53c19f49afbecdba9c7ae367ad7dd5b026ad99f65e6b74ed98c0b8a39583.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\Cfdhkhjj.exe
  C:\Windows\system32\Cfdhkhjj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\Ceehho32.exe
    C:\Windows\system32\Ceehho32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\Cjbpaf32.exe
      C:\Windows\system32\Cjbpaf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4956
      - C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        13⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 408
        14⤵
        Program crash
        
        PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3600 -ip 3600
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Calhnpgn.exe

Path C:\Windows\SysWOW64\Calhnpgn.exe
Size 467KB
SHA256 89469a66097ac8b833910be79ec178be542bc652fcfe2137d8935bd58097518a
MD5 617dd6dfc9c77e628fbcc0577314fd3e
SHA1 860805532eab129fa63b211fc376c895338bdace
SHA512 b2e87dcd6a0432b91b34e15e7bd6fd7b70287db0aa4af208fdd79772780f6d9075117c60a4a0a0d1088d02a551a235e3da4f5fb67d43c407ea0e7394a2b0d644
SSDEEP 12288:LRR2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:LRR2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ceehho32.exe

Path C:\Windows\SysWOW64\Ceehho32.exe
Size 467KB
SHA256 9ed985d3a79fb89b8459695c4ce68ac4d9189511985a07d6cabd3b66e04245a4
MD5 8e89b591897e682006976cd1092d10cb
SHA1 d52549f4acaf80ca05826ed30600c1f577878150
SHA512 7803be0e47cd6e1981e6fba3d0fa3307f7ec5a4579c587f0f7904e4a525433bb1064057fc99de5be6cd518acb524d7c830172f5bcb368356e1e89d26ee3e4510
SSDEEP 12288:6XguhPujg2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:32PD2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfdhkhjj.exe

Path C:\Windows\SysWOW64\Cfdhkhjj.exe
Size 467KB
SHA256 142456c4468911cd5ebe8d69f1c37f0141383e3396a851e460f15fea74213e64
MD5 8883d28106f3c58786d07df2faf6f232
SHA1 b381a9e3d4aac7e285a2ca0052ddce8cd012719c
SHA512 71d30c703a94529949842ea6fb57b9c70984f7ad3ae5680960ee50f8e3f3aedb57026bd08b807ccc897740aa8f9958342785921353fbc52a9563b9c54b511ae0
SSDEEP 12288:r1o2CW2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:rsW2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjbpaf32.exe

Path C:\Windows\SysWOW64\Cjbpaf32.exe
Size 467KB
SHA256 644b66410194c420602dea247eb90c7350be7d957eedefd447fd5bd7b256f6c6
MD5 89753443ead64bebd4552868bb0a611d
SHA1 d00bb003ad88285219e31ae5a9028d9fef3bd016
SHA512 a152e7f4e2247ee788dba27bbbe947ae6c9b2abbec45eb09633d52ff219b28a12738429a5a48442bbf685d16565b6b514c145a065c38242c6b9ef673ab90d6b4
SSDEEP 12288:y0L4MKk2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:yM2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deagdn32.exe

Path C:\Windows\SysWOW64\Deagdn32.exe
Size 467KB
SHA256 f0d684c13db4e6f3a31a11c77ca8c36738718fa2d18f940c42e3ffad56464661
MD5 88a59d58a05d9875cf5934295c681284
SHA1 032e81df4bd7eab95b38071dad51bccb8701f777
SHA512 bdfb6a4584361f7ed583678eb715117ded2754fe0e60d1ac9c1a81384249661b56c1bde99d25096c4f545ff59128b7089f58cd67326448d3e4f7cb182b6dbd0c
SSDEEP 12288:HfcX+R3lBtzaAk2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:HXR9zaB2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Delnin32.exe

Path C:\Windows\SysWOW64\Delnin32.exe
Size 467KB
SHA256 d8843d05d2f1b6f0af50c83647eb0cfd9ca44ab7c1fe78f50477d7352001cbf6
MD5 887713d0aa3f8c97d82d51408719f93d
SHA1 1dc288d7b14f88193aefa1706d9e44f2b6e793fb
SHA512 19c62f53c1af33025837565b811e4d6480bd321e4a70482e410001d010093c38d53380ffc26ace520def56ff4f3b571959544cf9536ef32caa214e1967dd3a62
SSDEEP 12288:aa5FyA2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:ZB2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfknkg32.exe

Path C:\Windows\SysWOW64\Dfknkg32.exe
Size 467KB
SHA256 a807937387f736d1058434eaa21499fe42c7e8b89f69845ec7a8db9950e5c35d
MD5 b712527ee7dd75d27fcf0314a4f8a644
SHA1 38166bbea88af5a9fbb7bdd2bcad0bf09eaa2580
SHA512 7a2d7ba8a19da85eb6f669780e988736834847c92daa4f61018a011a48913422f2c92c6524972026bf71fcfd8a31cf3c32688fdf46a8dcc8b1772568b4f33037
SSDEEP 12288:62zX3Y/Uy2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:62k/Uy2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfnjafap.exe

Path C:\Windows\SysWOW64\Dfnjafap.exe
Size 467KB
SHA256 bbb1f01d80684320d4260893ffaed96a3b92d87f9036dc42306c7c46d4f50bb0
MD5 80f1dbfd524bd44df87cd7b775cc8444
SHA1 7ca2d0edb7a6062c8823bf4eca1d64792fbbf93e
SHA512 b3d70981d280b0209e9d7906aa2b81ee76b8b731c1fb0f9c4cae8f808aadc55d1eb4f02b23b79017b31468bc5898aa4d4e356708ebf96cef1a3ef6edde25becb
SSDEEP 12288:nmP9a2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:mPA2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dgbdlf32.exe

Path C:\Windows\SysWOW64\Dgbdlf32.exe
Size 467KB
SHA256 929681da3d2b76d37553cf7ff3eac3d95f9603c8aea1d72e2a5c032369c661e9
MD5 07da0057217e7d7cb11d7b0e828d93fb
SHA1 7c972992e2fcdccf613d7e9911f118cdd7b959b2
SHA512 b46603c6a54d132c43c4800e7cff4d5c53f23e3146935a1befa8e1f36be19c70a76e2da845696450f988b645a6a58a81586dd886b7dc7006cd9948d816c1046a
SSDEEP 12288:KNZtmj2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:KXt42o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmllipeg.exe

Path C:\Windows\SysWOW64\Dmllipeg.exe
Size 467KB
SHA256 37d2ffd3262feb45d88021494ec7d8735d0821768a6740e124c095e3c9bc58dd
MD5 572607c1a31b03a74e19d8aad2750664
SHA1 bbce20bfecd4b1009d102532ebdf0124679dcc89
SHA512 7d10e8b3a4c207f1bf7ace9f0f5aaf15d5e518a8b87a5c67c25feb6b754332daa69ef243b638ed7b6257e198d9818b1f7f480b173b4da4b3228870ba16fd3909
SSDEEP 12288:ktcJP2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:kOh2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dobfld32.exe

Path C:\Windows\SysWOW64\Dobfld32.exe
Size 467KB
SHA256 1f25e415ce397e57c9d4969518f6192ee3b0cd901a7b92003d4b064ed33933c5
MD5 21617e100803c148f5b7f32f03c04545
SHA1 18da754822a599cb70a79f98a97f3991e4bddfca
SHA512 22086f84bfee587bc45a56e46d1ff7245f65028ba0a317c7fe08ef23178b38416b6686f6f4182b16b92ba1840b50aa9b86939f9f3085b1bb9040cacbdd658bb3
SSDEEP 12288:/K28K4a2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:iJna2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dopigd32.exe

Path C:\Windows\SysWOW64\Dopigd32.exe
Size 467KB
SHA256 90f3484b05eac878fd99218a1bb3a3c13cb2aae965c22ed5ca5f151bbe881038
MD5 5c4b78e59958ef5cfcbd205eff51b471
SHA1 a16f540a4c2fe57872773ef8b47d59f6147087ea
SHA512 2f0930c67976ddbed72bf10fc5c9d4c2f966b4dcd1771a51176e8e16a5cbe5de20f826e5b1440d5464afa0f6b8668371c75288e41e6ddbcbbaa65c9d4d03ee36
SSDEEP 12288:jSOy90w2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:jhyP2o8wDW8wQvr4B9f01ZmQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hcjccj32.dll

Path C:\Windows\SysWOW64\Hcjccj32.dll
Size 7KB
SHA256 511f99cc69d4164dc8b43e80eb0687e1f131050aaa8fe22774b373c20dcca763
MD5 59bebf30814c8b8c00d05c5099ab99ca
SHA1 910a4ba7ef14ffe6a36e8b3690c6f2c105e45c25
SHA512 b1e643e81875521d60ebc3fe7765bc3185ae3c024144087370026c8379aceed1827483f0db98ef667605c0bcdf4a7cd5e4893fdaddac690804bd46faa68bc4b2
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPId3cX5aXW:wUaJf/aFbP0Oj2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1540-66-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1540-112-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1700-106-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1700-70-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2108-24-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2108-116-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2300-101-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2300-94-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2956-121-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2956-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3216-8-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3216-120-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3256-93-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3256-103-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3388-20-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3388-118-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3600-97-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3600-95-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4004-110-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4004-69-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4828-108-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4844-104-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4956-31-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4956-115-0x0000000000400000-0x0000000000467000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads