b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exe
Size

10.9MB
MD5

2316f5296b4fc4ad7b7c841e4f300ed7
SHA1

f29c4fac6526c9ae0914829b53c69d9aa4367622
SHA256

b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b
SHA512

872d19dbb2a82c427141ed7e8a1bf8b95974fb6b50d9e41d94f106b98d392d542974c951eeb58e9aac05142d472f6a1f2325265a88f62d35248f2cb0ad847b6b
SSDEEP

196608:XnJEf8bmmacTw84X7oOnyeT3MPR+qa6QYWRQ4OjamYsv2WPySRclWq1+m/R7cSzA:3CfEocTw84sOn5bv7Y4ojvHuuyecXxJQ

Score

10^/10

bootkit discovery evasion persistence spyware stealer

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

wmcSystem7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\8150:TCP = "8150:TCP:*:Enabled:8150"	wmcSystem7.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	wmcSystem7.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	wmcSystem7.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	wmcSystem7.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	wmcSystem7.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List	wmcSystem7.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts	wmcSystem7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\8150:TCP = "8150:TCP:*:Enabled:8150"	wmcSystem7.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List	wmcSystem7.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts	wmcSystem7.exe

Drops file in Drivers directory 5 IoCs

Processes:

wmcSystem7.exewmcSystem7.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\WM7F.inf	wmcSystem7.exe
File created	C:\Windows\System32\drivers\WM7F.inf	wmcSystem7.exe
File created	C:\Windows\System32\drivers\WM7F.sys	wmcSystem7.exe
File opened for modification	C:\Windows\System32\drivers\WM7F.inf	wmcSystem7.exe
File created	C:\Windows\system32\drivers\cbregistry20.sys	wmcSystem7.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3980 netsh.exe

pid	process
3980	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exewmcUpdater.exePCScript.exewmcSystem7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	wmcUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	PCScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	wmcSystem7.exe

Executes dropped EXE 14 IoCs

Processes:

PCScript.exewmcSystem7.exewmcSystem7.exewmcSystem7.exewmcUpdater.exewmcUpdater.exewmcUpdater.exeScheduleTask.exewmcUpdater.exewmcUpdater.exewmcUser7.exewmcProc7.exewmcUser7.exewmcUser7.exe

pid	process
4420	PCScript.exe
832	wmcSystem7.exe
3708	wmcSystem7.exe
1580	wmcSystem7.exe
720	wmcUpdater.exe
3480	wmcUpdater.exe
4380	wmcUpdater.exe
4368	ScheduleTask.exe
3480	wmcUpdater.exe
1976	wmcUpdater.exe
4788	wmcUser7.exe
2440	wmcProc7.exe
4412	wmcUser7.exe
720	wmcUser7.exe

Loads dropped DLL 13 IoCs

Processes:

wmcSystem7.exewmcSystem7.exewmcSystem7.exeregsvr32.exeregsvr32.exeregsvr32.exewmcUser7.exewmcProc7.exewmcUser7.exewmcUser7.exe

pid	process
3708	wmcSystem7.exe
832	wmcSystem7.exe
1580	wmcSystem7.exe
1720	regsvr32.exe
3888	regsvr32.exe
1580	wmcSystem7.exe
220	regsvr32.exe
4788	wmcUser7.exe
4788	wmcUser7.exe
2440	wmcProc7.exe
2440	wmcProc7.exe
4412	wmcUser7.exe
720	wmcUser7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

rundll32.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmcSystem7.exe

description	ioc	process
File opened (read-only)	\??\B:	wmcSystem7.exe
File opened (read-only)	\??\J:	wmcSystem7.exe
File opened (read-only)	\??\Z:	wmcSystem7.exe
File opened (read-only)	\??\E:	wmcSystem7.exe
File opened (read-only)	\??\G:	wmcSystem7.exe
File opened (read-only)	\??\M:	wmcSystem7.exe
File opened (read-only)	\??\O:	wmcSystem7.exe
File opened (read-only)	\??\A:	wmcSystem7.exe
File opened (read-only)	\??\K:	wmcSystem7.exe
File opened (read-only)	\??\Q:	wmcSystem7.exe
File opened (read-only)	\??\U:	wmcSystem7.exe
File opened (read-only)	\??\P:	wmcSystem7.exe
File opened (read-only)	\??\S:	wmcSystem7.exe
File opened (read-only)	\??\W:	wmcSystem7.exe
File opened (read-only)	\??\L:	wmcSystem7.exe
File opened (read-only)	\??\F:	wmcSystem7.exe
File opened (read-only)	\??\I:	wmcSystem7.exe
File opened (read-only)	\??\V:	wmcSystem7.exe
File opened (read-only)	\??\Y:	wmcSystem7.exe
File opened (read-only)	\??\D:	wmcSystem7.exe
File opened (read-only)	\??\H:	wmcSystem7.exe
File opened (read-only)	\??\N:	wmcSystem7.exe
File opened (read-only)	\??\R:	wmcSystem7.exe
File opened (read-only)	\??\T:	wmcSystem7.exe
File opened (read-only)	\??\X:	wmcSystem7.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

wmcSystem7.exe

description ioc process

File opened for modification \??\PhysicalDrive0 wmcSystem7.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	wmcSystem7.exe

Drops file in System32 directory 17 IoCs

Processes:

PCScript.exewmcSystem7.exewmcUpdater.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\WinNetDaily.dll	PCScript.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	wmcSystem7.exe
File opened for modification	C:\Windows\system32\HuRMS.exe	PCScript.exe
File created	C:\Windows\system32\pcinfo7.exe	PCScript.exe
File created	C:\Windows\SysWOW64\pcinfo7.exe	PCScript.exe
File opened for modification	C:\Windows\SysWOW64\pcinfo7.exe	PCScript.exe
File opened for modification	C:\Windows\SysWOW64\HuRMS.exe	PCScript.exe
File opened for modification	C:\Windows\SysWOW64\wmcUpdater.exe	wmcUpdater.exe
File created	C:\Windows\system32\cbregistryevtmsg.dll	wmcSystem7.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_40D0130602ECE8F2862E76322B299508	wmcSystem7.exe
File created	C:\Windows\SysWOW64\wmcUpdater.exe	wmcUpdater.exe
File opened for modification	C:\Windows\system32\pcinfo7.exe	PCScript.exe
File created	C:\Windows\system32\WinNetDaily.dll	PCScript.exe
File opened for modification	C:\Windows\system32\WinNetDaily.dll	PCScript.exe
File created	C:\Windows\SysWOW64\WinNetDaily.dll	PCScript.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	wmcSystem7.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_40D0130602ECE8F2862E76322B299508	wmcSystem7.exe

Drops file in Program Files directory 64 IoCs

Processes:

PCScript.exewmcSystem7.exewmcSystem7.exe

description	ioc	process
File created	C:\Program Files\WW2017CF\cbfsfilter20.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\FoxSDKU32w.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\GCBClient.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\WinNetDaily.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcEncryption7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\WM7F.inf.w8_x64_Signed	wmcSystem7.exe
File created	C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\PolicyViewer.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\WM7F.cab	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcHook764.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcUpdater.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\PCInfo7.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\Policy	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\smr.cer	PCScript.exe
File created	C:\Program Files\WW2017CF\Updater7.ini	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcMemmgr.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcRCSlaveX7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\Info\DatBackup\SoftwareX64.txt	wmcSystem7.exe
File opened for modification	C:\Program Files\WW2017CF\Info\ADUserInfo.txt	wmcSystem7.exe
File opened for modification	C:\Program Files\WW2017CF\Policy\Log\2024_04_19.log	wmcSystem7.exe
File created	C:\Program Files\WW2017CF\wmcWatermark_DLL.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\PCInfo7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\ScheduleTask.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\smr.cer	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcDataBurner7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcMemmgr64.dll	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcService7.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\WM7F.sys.w8_x64_Signed	wmcSystem7.exe
File opened for modification	C:\Program Files\WW2017CF\Info\PCInfo.opt	wmcSystem7.exe
File opened for modification	C:\Program Files\WW2017CF\ScheduleTask.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcDataBurner7.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcUpdater.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\Info\LogonInfo.opt	wmcSystem7.exe
File opened for modification	C:\Program Files\WW2017CF\WinNetDaily.dll	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcProc7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcProc7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcRCSlave7.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcRCSlaveX7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\Info\MachineSWInfo.opt	wmcSystem7.exe
File opened for modification	C:\Program Files\WW2017CF\FoxSDKU32w.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\Info\RemoteService.opt	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\winet.lnk	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\WM7F.inf.w8_x64_Signed	wmcSystem7.exe
File opened for modification	C:\Program Files\WW2017CF\Policy\System	PCScript.exe
File created	C:\Program Files\WW2017CF\ServerSchTask.dat	PCScript.exe
File created	C:\Program Files\WW2017CF\Version.dat	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcEnterprise.dat	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcHook7.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcHook764.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcService7.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcSystem7.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcUser7.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\WM7F.sys.w8_x64_Signed	wmcSystem7.exe
File opened for modification	C:\Program Files\WW2017CF\cbregistry.cab	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\Info	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcEncryption7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcMemmgr.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcSystem7.exe	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\cbfsfilter20.dll	PCScript.exe
File created	C:\Program Files\WW2017CF\cbfsfilter2032.dll	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\Updater7.ini	PCScript.exe
File opened for modification	C:\Program Files\WW2017CF\wmcFTSlave7.exe	PCScript.exe
File created	C:\Program Files\WW2017CF\wmcFTSlave7.exe	PCScript.exe

Drops file in Windows directory 41 IoCs

Processes:

wmcUser7.exewmcSystem7.exewmcUser7.exewmcSystem7.exewmcUpdater.exewmcUpdater.exewmcUser7.exewmcSystem7.exewmcProc7.exewmcUpdater.exeScheduleTask.exewmcUpdater.exewmcUpdater.exe

description	ioc	process
File created	C:\Windows\Debug\WM7\Client\Network\LogWriteTest.txt	wmcUser7.exe
File created	C:\Windows\inf\oem2.PNF	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\Client\wmcUser7.exe\20240419.log	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\AutoUpdate\20240419.log	wmcUpdater.exe
File opened for modification	C:\Windows\Debug\WM7\AutoUpdate\20240419.log	wmcUpdater.exe
File created	C:\Windows\Debug\WM7\SystemDisk.opt	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\Client\wmcUser7.exe\20240419.log	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\wmcUser7.exe\LogWriteTest.txt	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\FileMonitor\LogWriteTest.txt	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt	wmcSystem7.exe
File created	C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt	wmcSystem7.exe
File created	C:\Windows\Debug\WM7\Client\wmcProc7.exe\LogWriteTest.txt	wmcProc7.exe
File created	C:\Windows\Debug\WM7\Client\wmcUser7.exe\20240419.log	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\FileMonitor\LogWriteTest.txt	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\Network\LogWriteTest.txt	wmcUser7.exe
File opened for modification	C:\Windows\Debug\WM7\AutoUpdate\20240419.log	wmcUpdater.exe
File opened for modification	C:\Windows\Debug\SMR7\ScheduleTask\2024_04_19.log	ScheduleTask.exe
File created	C:\Windows\Debug\WM7\Client\wmcProc7.exe\20240419.log	wmcProc7.exe
File created	C:\Windows\Debug\WM7\Client\Network\LogWriteTest.txt	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\Client\wmcProc7.exe\20240419.log	wmcProc7.exe
File opened for modification	C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240419.log	wmcSystem7.exe
File created	C:\Windows\Debug\WM7\Client\FileMonitor\LogWriteTest.txt	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\FileMonitor\LogWriteTest.txt	wmcProc7.exe
File created	C:\Windows\Debug\WM7\Client\Network\LogWriteTest.txt	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\wmcUser7.exe\LogWriteTest.txt	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\FileMonitor\LogWriteTest.txt	wmcSystem7.exe
File created	C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240419.log	wmcSystem7.exe
File created	C:\Windows\Debug\WM7\Client\Network\LogWriteTest.txt	wmcProc7.exe
File created	C:\Windows\Debug\WM7\Client\Network\LogWriteTest.txt	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240419.log	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\AutoUpdate\20240419.log	wmcUpdater.exe
File created	C:\Windows\Debug\WM7\Client\FileMonitor\LogWriteTest.txt	wmcSystem7.exe
File created	C:\Windows\Debug\WM7\Client\FileMonitor\LogWriteTest.txt	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\AutoUpdate\20240419.log	wmcUpdater.exe
File created	C:\Windows\Debug\WM7\Client\wmcUser7.exe\LogWriteTest.txt	wmcUser7.exe
File created	C:\Windows\inf\oem0.PNF	wmcSystem7.exe
File created	C:\Windows\inf\oem1.PNF	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\Client\wmcUser7.exe\20240419.log	wmcUser7.exe
File created	C:\Windows\Debug\WM7\Client\Network\LogWriteTest.txt	wmcSystem7.exe
File opened for modification	C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240419.log	wmcSystem7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmcSystem7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmcSystem7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmcSystem7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmcSystem7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ContainerID	wmcSystem7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	wmcSystem7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	wmcSystem7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmcSystem7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	wmcSystem7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	wmcSystem7.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

wmcSystem7.execscript.execertutil.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wmcSystem7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\474A91C\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	wmcSystem7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\474A91C\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	wmcSystem7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\474A91C\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\474A91C\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	wmcSystem7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\AppxPackaging.dll,-1001 = "Trusted Packaged App Installation Authorities"	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	wmcSystem7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\474A91C\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\474A91C	wmcSystem7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\474A91C\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	wmcSystem7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	wmcSystem7.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exePCScript.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\ProgID\ = "FoxBurnerCOM.FoxDiskSession.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90FDB7BD-EB76-4AC9-8385-D1EE80BBCDCD}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D865F1E7-BAC6-4ECA-B37B-0A5DDFF2D031}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68051560-DBA7-4939-8E34-4A8F28313E65}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05755065-6ECA-4F26-A3B1-0AE425B0EE07}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA6D55E7-F279-42BA-AEC5-5338C5CE5B30}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jsef	PCScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurner.FoxBurner\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E95E1D-D003-42A0-91FD-465DC624BC7A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D865F1E7-BAC6-4ECA-B37B-0A5DDFF2D031}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55A560A7-E3F9-4790-8D22-F3A97009AC8F}\1.1\HELPDIR\ = "C:\\Program Files\\WW2017CF\\"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA68A3FF-C69C-4FE8-947B-BD561EE15EFA}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\AppID = "{C6EDF056-F922-4B2E-A7A7-03DA4CC5518C}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA68A3FF-C69C-4FE8-947B-BD561EE15EFA}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\Insertable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BAF7A82C-443E-4FF5-8A04-286E30C67553}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A02A65C1-50E4-4E5D-B9D0-625D5DEBC671}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68051560-DBA7-4939-8E34-4A8F28313E65}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BBBF946-057B-4B1E-BCD4-5AB8F32DB7A1}\ = "DXceedSHAHashingMethod"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA6D55E7-F279-42BA-AEC5-5338C5CE5B30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDeviceCapabilities\ = "FoxDeviceCapabilities Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RijndaelEncryptionMethod.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F9F8921-D7A9-47E4-A0D5-B5F2CA673408}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA68A3FF-C69C-4FE8-947B-BD561EE15EFA}\InprocServer32\ = "C:\\Program Files\\WW2017CF\\FoxSDKU32w.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF814B45-2ED1-4471-B151-89E6D49AD3E5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0521D27-066B-4207-900B-6C3DF64B3CA0}\1.0\HELPDIR\ = "C:\\Program Files\\WW2017CF"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90FDB7BD-EB76-4AC9-8385-D1EE80BBCDCD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}\ProgID\ = "Xceed.Hashing.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05755065-6ECA-4F26-A3B1-0AE425B0EE07}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C8D3206-4A88-43D9-BB91-0ECC8C5F79CF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBA63CAC-9913-4A13-9212-E97BB70C05C9}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C14B6BF4-85A9-4DDF-BD42-59928595634F}\ = "IFoxDeviceCapabilities"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.Signing	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05755065-6ECA-4F26-A3B1-0AE425B0EE07}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF814B45-2ED1-4471-B151-89E6D49AD3E5}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDeviceCapabilities.1\CLSID\ = "{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.HavalHashingMethod\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065BFAE3-3448-4E31-BAAC-CB599C7AAA24}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BAF7A82C-443E-4FF5-8A04-286E30C67553}\ = "IFoxDiskDirectory"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C14B6BF4-85A9-4DDF-BD42-59928595634F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081A14B-77EC-4451-ABA0-20957C818BFE}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081A14B-77EC-4451-ABA0-20957C818BFE}\ = "DXceedRSAEncryptionMethod"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jm7e\Shell\open	PCScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\AppID = "{C6EDF056-F922-4B2E-A7A7-03DA4CC5518C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF814B45-2ED1-4471-B151-89E6D49AD3E5}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RSASigningMethod.1\ = "XceedRSASigningMethod Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F066CCAD-163A-4617-BA3C-BA4A4F80320C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA6D55E7-F279-42BA-AEC5-5338C5CE5B30}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C8D3206-4A88-43D9-BB91-0ECC8C5F79CF}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C8D3206-4A88-43D9-BB91-0ECC8C5F79CF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E95E1D-D003-42A0-91FD-465DC624BC7A}\InprocServer32\ = "C:\\Program Files\\WW2017CF\\XceedCry.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA68A3FF-C69C-4FE8-947B-BD561EE15EFA}\TypeLib\ = "{D0521D27-066B-4207-900B-6C3DF64B3CA0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\TypeLib\ = "{D0521D27-066B-4207-900B-6C3DF64B3CA0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C6F5554-32C4-4304-A235-B5F2B97F1B20}\TypeLib\ = "{D0521D27-066B-4207-900B-6C3DF64B3CA0}"	regsvr32.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

wmcSystem7.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E	wmcSystem7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 040000000100000010000000f55da450a5fb287e1e0f0dcc965756ca140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc60300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff190000000100000010000000b009e99a5cfc928a173190106dbb32a92000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	wmcSystem7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 5c000000010000000400000080010000190000000100000010000000b009e99a5cfc928a173190106dbb32a90f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6040000000100000010000000f55da450a5fb287e1e0f0dcc965756ca2000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	wmcSystem7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

wmcSystem7.exePCScript.exewmcUser7.exewmcProc7.exewmcUser7.exe

pid	process
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
4420	PCScript.exe
4420	PCScript.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
4788	wmcUser7.exe
4788	wmcUser7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
2440	wmcProc7.exe
2440	wmcProc7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
4412	wmcUser7.exe
4412	wmcUser7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe
1580	wmcSystem7.exe

Suspicious behavior: LoadsDriver 7 IoCs

Processes:

pid process

656
656
656
656
656
656
656

pid	process
656
656
656
656
656
656
656

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

wmcSystem7.exe

description	pid	process
Token: SeDebugPrivilege	1580	wmcSystem7.exe
Token: SeDebugPrivilege	1580	wmcSystem7.exe
Token: SeDebugPrivilege	1580	wmcSystem7.exe
Token: SeDebugPrivilege	1580	wmcSystem7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

wmcUser7.exewmcProc7.exe

pid process

4788 wmcUser7.exe
2440 wmcProc7.exe

pid	process
4788	wmcUser7.exe
2440	wmcProc7.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exePCScript.exewmcSystem7.exewmcSystem7.exeregsvr32.exeregsvr32.exerundll32.exerunonce.exewmcUpdater.exe

description	pid	process	target process
PID 4392 wrote to memory of 4420	4392	b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exe	PCScript.exe
PID 4392 wrote to memory of 4420	4392	b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exe	PCScript.exe
PID 4392 wrote to memory of 4420	4392	b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exe	PCScript.exe
PID 4420 wrote to memory of 1044	4420	PCScript.exe	reg.exe
PID 4420 wrote to memory of 1044	4420	PCScript.exe	reg.exe
PID 4420 wrote to memory of 1044	4420	PCScript.exe	reg.exe
PID 4420 wrote to memory of 832	4420	PCScript.exe	wmcSystem7.exe
PID 4420 wrote to memory of 832	4420	PCScript.exe	wmcSystem7.exe
PID 4420 wrote to memory of 3708	4420	PCScript.exe	wmcSystem7.exe
PID 4420 wrote to memory of 3708	4420	PCScript.exe	wmcSystem7.exe
PID 832 wrote to memory of 4404	832	wmcSystem7.exe	rundll32.exe
PID 832 wrote to memory of 4404	832	wmcSystem7.exe	rundll32.exe
PID 1580 wrote to memory of 4832	1580	wmcSystem7.exe	regsvr32.exe
PID 1580 wrote to memory of 4832	1580	wmcSystem7.exe	regsvr32.exe
PID 1580 wrote to memory of 4968	1580	wmcSystem7.exe	regsvr32.exe
PID 1580 wrote to memory of 4968	1580	wmcSystem7.exe	regsvr32.exe
PID 4832 wrote to memory of 1720	4832	regsvr32.exe	regsvr32.exe
PID 4832 wrote to memory of 1720	4832	regsvr32.exe	regsvr32.exe
PID 4832 wrote to memory of 1720	4832	regsvr32.exe	regsvr32.exe
PID 4968 wrote to memory of 3888	4968	regsvr32.exe	regsvr32.exe
PID 4968 wrote to memory of 3888	4968	regsvr32.exe	regsvr32.exe
PID 4968 wrote to memory of 3888	4968	regsvr32.exe	regsvr32.exe
PID 4404 wrote to memory of 220	4404	rundll32.exe	runonce.exe
PID 4404 wrote to memory of 220	4404	rundll32.exe	runonce.exe
PID 1580 wrote to memory of 2244	1580	wmcSystem7.exe	certutil.exe
PID 1580 wrote to memory of 2244	1580	wmcSystem7.exe	certutil.exe
PID 220 wrote to memory of 4080	220	runonce.exe	grpconv.exe
PID 220 wrote to memory of 4080	220	runonce.exe	grpconv.exe
PID 4420 wrote to memory of 720	4420	PCScript.exe	wmcUpdater.exe
PID 4420 wrote to memory of 720	4420	PCScript.exe	wmcUpdater.exe
PID 4420 wrote to memory of 720	4420	PCScript.exe	wmcUpdater.exe
PID 720 wrote to memory of 3480	720	wmcUpdater.exe	wmcUpdater.exe
PID 720 wrote to memory of 3480	720	wmcUpdater.exe	wmcUpdater.exe
PID 720 wrote to memory of 3480	720	wmcUpdater.exe	wmcUpdater.exe
PID 4420 wrote to memory of 3980	4420	PCScript.exe	netsh.exe
PID 4420 wrote to memory of 3980	4420	PCScript.exe	netsh.exe
PID 4420 wrote to memory of 3980	4420	PCScript.exe	netsh.exe
PID 4420 wrote to memory of 220	4420	PCScript.exe	regsvr32.exe
PID 4420 wrote to memory of 220	4420	PCScript.exe	regsvr32.exe
PID 4420 wrote to memory of 220	4420	PCScript.exe	regsvr32.exe
PID 4420 wrote to memory of 4368	4420	PCScript.exe	ScheduleTask.exe
PID 4420 wrote to memory of 4368	4420	PCScript.exe	ScheduleTask.exe
PID 4420 wrote to memory of 4368	4420	PCScript.exe	ScheduleTask.exe
PID 4420 wrote to memory of 3480	4420	PCScript.exe	wmcUpdater.exe
PID 4420 wrote to memory of 3480	4420	PCScript.exe	wmcUpdater.exe
PID 4420 wrote to memory of 3480	4420	PCScript.exe	wmcUpdater.exe
PID 4420 wrote to memory of 1976	4420	PCScript.exe	wmcUpdater.exe
PID 4420 wrote to memory of 1976	4420	PCScript.exe	wmcUpdater.exe
PID 4420 wrote to memory of 1976	4420	PCScript.exe	wmcUpdater.exe
PID 1580 wrote to memory of 2664	1580	wmcSystem7.exe	cscript.exe
PID 1580 wrote to memory of 2664	1580	wmcSystem7.exe	cscript.exe
PID 1580 wrote to memory of 3688	1580	wmcSystem7.exe	cscript.exe
PID 1580 wrote to memory of 3688	1580	wmcSystem7.exe	cscript.exe
PID 1580 wrote to memory of 3960	1580	wmcSystem7.exe	cscript.exe
PID 1580 wrote to memory of 3960	1580	wmcSystem7.exe	cscript.exe
PID 1580 wrote to memory of 4788	1580	wmcSystem7.exe	wmcUser7.exe
PID 1580 wrote to memory of 4788	1580	wmcSystem7.exe	wmcUser7.exe
PID 1580 wrote to memory of 4788	1580	wmcSystem7.exe	wmcUser7.exe
PID 1580 wrote to memory of 2440	1580	wmcSystem7.exe	wmcProc7.exe
PID 1580 wrote to memory of 2440	1580	wmcSystem7.exe	wmcProc7.exe
PID 1580 wrote to memory of 4412	1580	wmcSystem7.exe	wmcUser7.exe
PID 1580 wrote to memory of 4412	1580	wmcSystem7.exe	wmcUser7.exe
PID 1580 wrote to memory of 4412	1580	wmcSystem7.exe	wmcUser7.exe
PID 1580 wrote to memory of 720	1580	wmcSystem7.exe	wmcUser7.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

wmcSystem7.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer wmcSystem7.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	wmcSystem7.exe

C:\Users\Admin\AppData\Local\Temp\b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exe
"C:\Users\Admin\AppData\Local\Temp\b8e17df35ceda8b537eafd8945813186a271b8874a47289e5f66c86501b41b6b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4392

C:\temp\PCScript.exe
"C:\temp\PCScript.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe export HKLM\SYSTEM\CurrentControlSet\Services\Win-Win7 "C:\Users\Public\SMR7\Debug\WinWin7.RegDebug.log"
3⤵
PID:1044

C:\Program Files\WW2017CF\wmcSystem7.exe
"C:\Program Files\WW2017CF\wmcSystem7.exe" -di
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\System32\drivers\WM7F.inf
4⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4404

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
5⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
6⤵
PID:4080

C:\Program Files\WW2017CF\wmcSystem7.exe
"C:\Program Files\WW2017CF\wmcSystem7.exe" -ai
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3708

C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
"C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe" -smr_inst
3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:720

C:\Windows\SysWOW64\wmcUpdater.exe
"C:\Windows\SysWOW64\wmcUpdater.exe" -smr_inst
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3480

C:\Windows\SysWOW64\netsh.exe
C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="WinMasterServices V7 Client7"
3⤵
- Modifies Windows Firewall
PID:3980

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /i /s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:220

C:\Program Files\WW2017CF\ScheduleTask.exe
"C:\Program Files\WW2017CF\ScheduleTask.exe" -SetSchedule
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4368

C:\Windows\SysWOW64\wmcUpdater.exe
"C:\Windows\SysWOW64\wmcUpdater.exe" -smr_run
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3480

C:\Windows\SysWOW64\wmcUpdater.exe
"C:\Windows\System32\wmcUpdater.exe" -smr_run
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1976

C:\Program Files\WW2017CF\wmcSystem7.exe
"C:\Program Files\WW2017CF\wmcSystem7.exe"
1⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1580

C:\Windows\System32\regsvr32.exe
/i /s "C:\Program Files\WW2017CF\XceedCry.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Program Files\WW2017CF\XceedCry.dll"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:1720

C:\Windows\System32\regsvr32.exe
/i /s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:4968

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:3888

C:\Windows\System32\certutil.exe
-addstore Root "C:\Program Files\WW2017CF\smr.cer"
2⤵
- Modifies data under HKEY_USERS
PID:2244

C:\Windows\System32\cscript.exe
C:\Windows\System32\cscript.exe "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
2⤵
- Modifies data under HKEY_USERS
PID:2664

C:\Windows\System32\cscript.exe
C:\Windows\System32\cscript.exe "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus
2⤵
PID:3688

C:\Windows\System32\cscript.exe
C:\Windows\System32\cscript.exe "C:\Program Files\Microsoft Office\Office15\ospp.vbs" /dstatus
2⤵
PID:3960

C:\Program Files\WW2017CF\wmcUser7.exe
"C:\Program Files\WW2017CF\wmcUser7.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Program Files\WW2017CF\wmcProc7.exe
"C:\Program Files\WW2017CF\wmcProc7.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2440

C:\Program Files\WW2017CF\wmcUser7.exe
"C:\Program Files\WW2017CF\wmcUser7.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4412

C:\Program Files\WW2017CF\wmcUser7.exe
"C:\Program Files\WW2017CF\wmcUser7.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:720

C:\Windows\SysWOW64\wmcUpdater.exe
"C:\Windows\SysWOW64\wmcUpdater.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WW2017CF\FoxSDKU32w.dll

Filesize
2.9MB

MD5
25e0bf4889612fc23561d79c942ada1c

SHA1
f9428cc4f4a9640a244875687178b43a74f4211e

SHA256
3a69e8fa1426b7cc4b837875c0bb5ca19f6b93fe49172f3e2dfa14256fd32d30

SHA512
8c4f6608b2e9930d38b8064a881b7a849b2f8f2222dfcd8915bf137a8ab4a616db56fc784c80600036dbcaa0351946171f17cd7160a8295a2310eed0efa9677d

Download Submit
C:\Program Files\WW2017CF\Info\BootInfo.opt

Filesize
140B

MD5
81950399a8c41481e7d0051b897e92e9

SHA1
32ec2e585b2a957370b847047279522a43e3d83d

SHA256
531851c84c129c35e709de98af7197e360b9cf17610105715611bbfb7bcf9b49

SHA512
5d4bb5056d4b0a903c3cb0d73047539c2e305ae4c860018cb4a451b508bc80de36ac48fd10616912c9174ac411942280daf995df64acc9db193d804b5bb5367c

Download Submit
C:\Program Files\WW2017CF\Info\LogonInfo.opt

Filesize
215B

MD5
d3fae513f3fe52f9d7accb93fe8ad7d3

SHA1
4c3c29b087d9fabb43633331a13e0872caa269a0

SHA256
397d7d8a386a2781deecaf9cdc7f659b9ab06bbaf2c4aae4c9cf6c809199cbba

SHA512
a0cbb13f6a6db69dd05ddbf9d89e7527afc434ab50ee6e36bbe68a4e9850133d75d46d514ae37b4016f017988d801180b3136d572f23b6dbc540a0ee13dd2a0c

Download Submit
C:\Program Files\WW2017CF\Info\LogonInfo.opt

Filesize
215B

MD5
0c85b1ee414878eb67b37ea6bf4d6309

SHA1
6161c9e29b589b31d04a276bd3d7917bde7ac71c

SHA256
fb02e7cee7a32b6bcbd7539eefef2c6839b65e248f29a9e55f9034619e5bd09c

SHA512
b4803848281578476d1c1bfcf47baf1d0d36746770b32ed1300b22a023bf323e960309c92142ddeec2b9c360bfb9ff35feb923a7376aa0056fe02d3505ab8e75

Download Submit
C:\Program Files\WW2017CF\Info\PCInfo.opt

Filesize
248B

MD5
ceb3a032128613b8469bdec3aa7fa9c9

SHA1
ecb2837fcb6d4420113c0bd16155792228f724d2

SHA256
aa06325ee34729a56fcbb071eb8e827b30e53c065038ceb8915fdbc5fe3a527b

SHA512
c24c2287bfd67c52dae7916db05bf9a2dfcb9970e7c18e431c23ed72230d352bad87cdbbea23ec12d7ac1e01bc52b27bfebb0aef1c0da21b40cdf9bfad345e25

Download Submit
C:\Program Files\WW2017CF\ServerSchTask.dat

Filesize
60B

MD5
aca73f319209e2556b36c21030592252

SHA1
2e5fe3b619642158dd224e189b9492eb0ceba7ee

SHA256
d7a6e2f0cc0f34b8c4a616516ccdbedb563acfc91de72ee9a3c2cf26da70efbb

SHA512
85de70bcc089fa308b8b3a68cbb924ab4473fb34c2fe2627856bbce9a4114dba7b254e9ea3992038bde65d5717e6242b7fe592b9676eea542a10d4be9ee8f366

Download Submit
C:\Program Files\WW2017CF\Updater7.ini

Filesize
81B

MD5
70f1d3e435ad52f73b9a2fd99bda7215

SHA1
07e524460d637d2356a70c6a8c2f9e45f9c37acd

SHA256
8d91d4d13ccb53493e472cd5f87fca17e0773d4864ba9f6e44979313cd56a822

SHA512
7d1524094ffd0dfdef9e39fb768824e48e7895d46f8bd0f636ef712861b944acc8c6f33d1280377131121824033c448a99563d8afc3a2b1a37f13a094058b0d2

Download Submit
C:\Program Files\WW2017CF\Version.dat

Filesize
28B

MD5
a8d9d68de8f167e9023464ed638b0b9d

SHA1
520df857ee138bf1d222c6c1d00fc6ba4f490e66

SHA256
ea46a753861d1fa7ad87f329c00f5d3d2f82836d38bc7653b7ae5a08b300dce4

SHA512
ac02610feb310de6c51648447ecdeb0ac7089220af0f89f4874cc906dc2b1591920f7d706c178541ef7cf55802da760df8e4fa8f5eeb285c60f5ddab6ae28aaa

Download Submit
C:\Program Files\WW2017CF\WM7F.cab

Filesize
596KB

MD5
55c171eb1056145149143255818a3352

SHA1
8e60c65053e29d8c94c575abd73eeeef05d43faa

SHA256
ca270c6cc9450450fe1eb82667861e6dcb6775582c3e97d44ddc96f0cce4382f

SHA512
17a27dfa5825d7c8b6b270bdb2167174501034c26f7020e3e21c21646bb0c428dacf1eb94be245f1157631af150120b9008b94f22d0b1dc9fdc5d1508ddd372f

Download Submit
C:\Program Files\WW2017CF\WM7F.inf.w8_x64_Signed

Filesize
2KB

MD5
cf9c0d78656c6c534dd507a88c99ac72

SHA1
f073d26c447ce6468ecb68948886f7adb40ed604

SHA256
ae6429929cf3419798fe6cd59bbd8c7c492c92e79dd6d32df368aa5c09264360

SHA512
4edb5eec216318ff0f514c9069c63a3a7a44f516915987d3e6fb8d27793679f6a0ef2a8dfa2d20bb85768cf53985c7f274d43eea47231072db3c6eaaaa824cd3

Download Submit
C:\Program Files\WW2017CF\WM7F.sys.w8_x64_Signed

Filesize
143KB

MD5
28772736ac10bcca04987cc215a5065c

SHA1
6ba6602f718b7fe6f1ce9d65ed86ea84d7755dac

SHA256
3545f4c15ecdff64b5d44f9505a002d3549b05a5a52a6fdc975db5d2dbe0efb8

SHA512
3188d3da55641f916ca68ba26c4a6208853c57e57be5661ee4e3b2e33749d7f089c669cfef624d230640a93513c22ac803287b9f6910772f49bbcbdbe03dfb3f

Download Submit
C:\Program Files\WW2017CF\WinNetDaily.dll

Filesize
7KB

MD5
6dc31af9f2b09740922065ea28b5eb3c

SHA1
4a1c267b30535aef8c3109f2104da9dd01c17f0c

SHA256
869941e24817fce286963877bad58b0de73486de1bcbfcc7f7d2f9056d514745

SHA512
4303263999c61414c6f29949c70c6cdc6a96cdf210708a39c84b0037a08a108c807a7f03620b7d3303449610c0cfe0ba4fb518e9f37917f983bc70a1e21a6321

Download Submit
C:\Program Files\WW2017CF\XceedCry.dll

Filesize
513KB

MD5
2c0c746eecffdcedd18450659f3a8ee6

SHA1
68dcbd003837545a07608ed3f2efa77612c30456

SHA256
ff9722c64be81caad50e14bb3f50f345b4a30ca76c87113292ff852e934590b3

SHA512
ccc2a0f7d3f18eb1ff3506cc8545e7fa72b05758bfeb8b5e8348de4f7648ff57deba69839f8b7d7a350d6cb383030267e81bb3d274aa62f1e9a6002d5b2a7751

Download Submit
C:\Program Files\WW2017CF\cbfsfilter2032.dll

Filesize
512KB

MD5
4efb2a895ecd3792eed52e850af847c9

SHA1
74e43921d052fecf4190c813c9ee56b37d79dea8

SHA256
8a21206fe6d151d5c18fa48d8bb6cb600190bdf62999c6cc7e53a31b8fcdc72c

SHA512
40a90f67830d7f1415f9781ccb09f2ec68b075004db238aadd09afb7a1b11b61c266d25f60c96966b0eb0aa3ed1531e2f9b04e4d1b2fe753cda68a59af26e6f6

Download Submit
C:\Program Files\WW2017CF\cbregistry.cab

Filesize
277KB

MD5
cbf0c82d8867a425a0a04527e89425f1

SHA1
7c946358da28fb35b62755e3854edfd349f8bf84

SHA256
ce731190ee0d63e9051b1ea58f305d49256a799e170de45baa3a5bc1b0bb5e9c

SHA512
e793e4ec38e8d031c568a94b559053504b44b0f5938d71ddedea2b09996e9cdb472f976f181f24e3a53c6c621d3936a7ed955e716e8d10b8867c39b45570dbf0

Download Submit
C:\Program Files\WW2017CF\smr.cer

Filesize
579B

MD5
f55da450a5fb287e1e0f0dcc965756ca

SHA1
7e04de896a3e666d00e687d33ffad93be83d349e

SHA256
31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

SHA512
19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

Download Submit
C:\Program Files\WW2017CF\winet.lnk

Filesize
748B

MD5
d34cbdf1a37e06133cf75c17eebbf58d

SHA1
db861919287928e8a5efeb930056c96bd9c815c3

SHA256
a55978e4257023fb61896e82bf006ca4d1a9a5b9c7994042355339ae688b0147

SHA512
dac577250345d2d5a40c8c96eeb489f19de1b3c7a3aee87e31146870216176bc9fcf94decbe1fee4dba60bc7a6b88fa2ff5d0b926097ac86ea9c47c1d62e372c

Download Submit
C:\Program Files\WW2017CF\wmcEnterprise.dat

Filesize
704B

MD5
e96943a1ddb61b42dc4dbb4df4d02906

SHA1
68f0609ac5ac89ff7f169cfea3504fc7668e7ea3

SHA256
00721e626e105d8cccce62bc17e413a4fa6b081a9c9022b4edd8a45062b6b2dd

SHA512
7514b2a6b9f4acb8c4b352a8fd99d4daef3b41b392fbe0a254eedae99e253d7849d7075b249660a8462ac2f5e607ed195a858e955c32eeaa09bb1162c061cd71

Download Submit
C:\Program Files\WW2017CF\wmcHook7.dll

Filesize
475KB

MD5
e39ca071aabc93d95a5613ac766880dd

SHA1
831985619da903e35e5cf8592acf6e24705169b0

SHA256
bdee91fde79924c57ff6fd390ce088c06f13367d90d01a793635c5a03a20af23

SHA512
89d9623a53aee60e6b23a850f8793e7cb28b574840625a8104b0d873f8230bd63a5c5008b7cf1c0aae62ef90f99314319c2a0ceeb4b69fb5839861f61d2239c9

Download Submit
C:\Program Files\WW2017CF\wmcHook764.dll

Filesize
527KB

MD5
0aabee8ee9844381eb3f9b31846707d8

SHA1
21244b7ef577735a360fd027294987e26b36534f

SHA256
971ad4391969d6d3716df0c35292249d33f526852403d5a6b383fc0acfee06aa

SHA512
286d1adda591fdd870fc8a571942cb6bb6bf2145d8b2ec274a13838732a997040afb58796856582f362b50ea4f88baed39be6f21c6a1f5471d6881e4968c84a4

Download Submit
C:\Program Files\WW2017CF\wmcMemmgr.dll

Filesize
252KB

MD5
259038b61882513526c365efd4e0bb23

SHA1
002df092161fb87c1dc5da64f882b0f125b2e1f3

SHA256
a3e449f6c561cdf01106fd5527cbee0a80f7fcc7a933d425cd21d7c8c1eca332

SHA512
1448b386a60dabbceab6a352144d98ff04e84c12b837b0d81e1bb450868a883f27116714a2da5493b4e6550fba400b3170e4e3ea9c636d7c2eadeccc23526b40

Download Submit
C:\Program Files\WW2017CF\wmcMemmgr64.dll

Filesize
287KB

MD5
10a19273d219cb3899f552e51a6d6f85

SHA1
8aea2fa3c7ba323deba6c0856b0cf6750bc56ae0

SHA256
fb2bb0c0677231624f0fb13a237ae97a062130f8e4240ccb09e3783691147be5

SHA512
b41bf79a21b1d42735a709eb949b5028463753b87bd1c2b37511f79430d5ea044bb54ac926cf1fa137e950a92546496a938fe7be379775532ff1c92d57cc4a6d

Download Submit
C:\Program Files\WW2017CF\wmcUpdater.exe

Filesize
221KB

MD5
d1c7295e1fd13765726d7ec5bcefa0a9

SHA1
2c22a4dc0b2939195f5482f3163ba9eff074a63a

SHA256
ddb553d332499d13dfb22e13dd4858d1a1193b6febcca5ee8746f8041e6b2f7e

SHA512
1c51b51d9d796a35abc5559313afca68a8e6e2f5bb317498991ddd0f55b7a7f53dd7c772644b93908be79f3a72653d731d94832767f96b0387b62845a7caf4a5

Download Submit
C:\Program Files\WW2017CF\wmcWatermark_DLL.dll

Filesize
163KB

MD5
1c3317f62bffac2f6c5d7b45b21d4383

SHA1
21ffb25c4c08ab9dc4fc9c685ae0d94eb01f937c

SHA256
a9048c4ca9067fef36dcc3864c8ad1c7575ad37b4b6c64319cc65ccefa0dd328

SHA512
9e5fc3658de7abae73dbe93f1a4c828eebf286b2484f33f4a4d3228bf56d5dcf20d0924d954d46fea49808445d5934e13db9461889dedd31ecdb9a0c8db19dec

Download Submit
C:\Program Files\WW2017CF\wmcWatermark_DLL64.dll

Filesize
189KB

MD5
e4baccce9a9fe8039d80f80311f8125e

SHA1
aa4ffc838eee4ec1b6ff8557f86a1bf3f4f0ce2b

SHA256
b03e84f1da173db88e3da1366add6f6a878cd62ae59bf2d2647d91f3d2147425

SHA512
2e3cb7b1351cdea6b24d96f1d8800354a9ca6b089d941071f6a889ee06f182e8e40c7a6a8322de26eb0f2c629e597a613ee14c5294a85a1c77e220794e0c5e19

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_1037f2ac-7687-4b04-90ea-cc9b87b0e187

Filesize
1KB

MD5
773c5608cf154f7966e1db62b1d0b0b7

SHA1
5b1e18b14c59c06f8cff4fab3d80e8f6d538eec6

SHA256
8ce50d32b493a35b687b2aa7cb6d5e87c956e7b397ca91210417d86e928e5e19

SHA512
eac28f3e3fb30665d61409f2f422cd7821c76ce2a0f80a3e7ea6ee3701011d8fe6cb6a5e0d53f0bfa0cf1d73151590a666827471e7de3cc8e26c0995a76930a5

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_1037f2ac-7687-4b04-90ea-cc9b87b0e187

Filesize
1KB

MD5
caa7b890e2ea88ae762d10e2508df15c

SHA1
c43acf7ca22b4ab39f93d5a8879e2512fd5ebb32

SHA256
eb6af902dea1e68096da405ba6ce88197422d408f5245f1c7f488657411e11a5

SHA512
026c975ba083fdb4882edb8cf062cdbf55c4340c2c8c447b2c09ae240d6e0d1417547f25165b2c499cedbc3b2fa6d483b2de57de90019780043e50ed0ebb9e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG3DD4.tmp

Filesize
4KB

MD5
e1157f67c6cca6462cfdd8478bae9bb9

SHA1
754c1051bb765c1e2387effcd891c72fa75459ea

SHA256
4d8da8292a1e19de3b79c493c60a2f3c0896735459c98e66b5b0c121072732f4

SHA512
eff0825a5e93a95a9fb829302ecba55042aec08ac6c7807475299a2e6a1f9f500a7783807c23d85becfca6e248f1e542f36b168a1b605ab5164b70246831db35

Download Submit
C:\Users\Public\SMR7\Debug\PCScript\2024_04_19_QUBJEIMO.log

Filesize
4KB

MD5
a71ba0e07b0f83c0ef0c4cb3ef7ab0de

SHA1
ccbe49d615c40abff7802c0a06e37b3ccef9f330

SHA256
99e4dc16b1914d3e145eb1a699c98b0d59464763faddd0ff518a420c2a16bdd8

SHA512
96aa2ef66e387cc05d763157e96ef3103bda0dc40e86ce957ba2a5727522969240db25254ca9eab7bbf02eb1406f6eaafc72f7c1a2fadf6d3bf0668246c02576

Download Submit
C:\Users\Public\SMR7\Debug\PCScript\2024_04_19_QUBJEIMO.log

Filesize
572B

MD5
e9b26f7ab97ada66010ee4bcc38c069b

SHA1
6ed18e4af3a9e477622695564373d40ce5b85f90

SHA256
e27af75301d7d40328393de8cf45174764337191881250e344035fe48e50725d

SHA512
19a0cbce299ec1f4a67bc97515bd445c8621717eedcf77e4b658d58433f915750b8bbdc71bfb2bd5d7450d96f10c2896a174d21ac0038214ba38ed2349dd205c

Download Submit
C:\Users\Public\SMR7\Debug\PCScript\2024_04_19_QUBJEIMO.log

Filesize
2KB

MD5
f7193b3fd47d5e2f15c1c6a4d701e4c1

SHA1
2b24d1650f9ccf9561277037a5a79cdcb3003872

SHA256
c7e27ccb7a75c96ec4586f998cfacbab62dd1d383b51bd5bdd40d1751a7e02e2

SHA512
e7d7c698927529e569498a469fa1ed883bfa70149048c880b3be5d416e362bb541649e06a847ed61761a022700fe1a91b200c07480fe7ed42a1f70389c1d97bf

Download Submit
C:\Users\Public\SMR7\WM7installTemp\GCBClient.exe

Filesize
984KB

MD5
15046e261804b798e870488418df4442

SHA1
2f6df86f4d5b7596b98b7be27b476e763db3957b

SHA256
6c2c971d0e9111b32d8ad0f7f109894d4b3e0195ce35f256030b7ac5585406a3

SHA512
0504316dc65fe52394e0a521b4bd867e12e4211d6c27bed4a9c402609a7bd44dd2d36639020f1a33665bd44da0fbb929163f2d76eac0db9908c418f453fda2c1

Download Submit
C:\Users\Public\SMR7\WM7installTemp\LogClient.exe

Filesize
2.4MB

MD5
7eca890761ef187f01b50b94d9ab003b

SHA1
63589186756bb4e13f01586391ba51047f65a002

SHA256
b5741784c4ee101fd41d28f104fbae1a3b88750a925f8b130e189bbd6025f998

SHA512
2dc8f29e46bd0311366674faee3ad4c30d678b518d4660b54cb193db42856706d0e17807369c76b211adc32af8e4a9c853ecb82a4b7b387fd5a269176cee444f

Download Submit
C:\Users\Public\SMR7\WM7installTemp\PCInfo7.exe

Filesize
122KB

MD5
83d262c08ae169e35c59da1d54c2b434

SHA1
4d6d4a8f2ea26555dfcefb7c44f6e30e87364a33

SHA256
1ae789d28365b4c1858bbb51dd6ff5576ce9f674766f6e618e6aec3a9fff9e9e

SHA512
4f0c0a5f69e48113f5fa7f9e7c3de7247d2e23c2c2d264b26d053b68116a27cd5079c82e656fb38ae56d9e790cc66d473e39da1cd4fcf441a91dbf8bdd3a95be

Download Submit
C:\Users\Public\SMR7\WM7installTemp\PolicyViewer40.exe

Filesize
76KB

MD5
3a1b35c59faee8f49564a844886c5e2f

SHA1
71eed14b8c1b39c74ff7a8d7f18555ab428e165b

SHA256
e836912ef4f75b7e208539fc0af37092e3a5b36e36324154e3ac5e270de826c8

SHA512
f32c8d0cf7464d6358328f57a5ded664a034931f47f52434343958adc6451ca4f6747faab5c307df0ed1db0f941d9dea31e110d74f01394a96faf51d325a9049

Download Submit
C:\Users\Public\SMR7\WM7installTemp\ScheduleTask.exe

Filesize
131KB

MD5
76ceaa70e5d5be3cc44bc4ca85b8abe1

SHA1
61d2ae724542f5cff3c0dc815162c6348d52e757

SHA256
24522ea3fa5551af7bfc3b5413f3ce6f5b10cbc035937641251779680def638a

SHA512
19e37d1fdf3b3dbe227c8e463d71bd2c785b6bb2f1bdd6b9a62a97afa9610b4cc920b671fde5e970d4a1605d878dc0cc09dec629bfa235c9d9c37f9b150bb396

Download Submit
C:\Users\Public\SMR7\WM7installTemp\cbfsfilter20.dll

Filesize
763KB

MD5
be8818d3615195035cd9975c47204a85

SHA1
309e2195d53f486afe3f87ed186dcc39ff79c7d9

SHA256
2340772c80a5f90801d307f1e8f3ff4e77d6fd0f7d643a837e429129988c1e8a

SHA512
7b1ab6fe500edba69a792daf6a06c2d17a43ccf89f4ee8c65fb1ca162beca027a02a9b89e95fde9bab8789f2de3eb677ab7fb4d1d8f3ca000b8d4a2e4035b344

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcDataBurner7.exe

Filesize
388KB

MD5
3d5ade8ec37e73e137e0fbc89996c713

SHA1
e76b4716767aca75d01fa57d08a6cc94b7d5267f

SHA256
6164152e64b4735d8afe023cf5cfac9ade1cd9af4e43b00719a7020cbcf0f394

SHA512
a415e9e6e21fcb37042bc04b4bf9280471e7a48d5d7996f5589f1a5ee758b6df1cd4259a91fc9457691b1defdf9596c2fa02cd6907ffcc985404d816b52b4713

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcEncryption7.exe

Filesize
331KB

MD5
363088c2cdc59af1f987e2fbdda52134

SHA1
c36df83f6cf9592345b9ba8af03b899e1de3c8de

SHA256
5f70f94e77c14239e651d220569fd95a9ae54080d5fee978851372c29db83976

SHA512
9891a9b7a535741dc2d22995feccdb55398c847425eab8e1f85f480da2ecdec73310840e5e4e6bc08a1f29872bafb8a0aa69e0400a24bb97611e0b6887eb9618

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcFTSlave7.exe

Filesize
458KB

MD5
b79326242d5e1b522435e3e75d0c44d1

SHA1
18f9d63521e315b94d9a2a27f8eab18d9462d9c6

SHA256
e6aba6bbc7428e10839cc6e2d3d54059ea1011c705ff32f2b19093e8a70d1d0f

SHA512
1604be86b04fce6a604fd54e8111a79ece1667c71afed5e8c04495b34f9eb0120836f753f295d8b8bcb4666749a408cd62f7bc516d7be60889e7a5ccc1af3206

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcProc7.exe

Filesize
504KB

MD5
37f9dcb25495b5acbf81379f134c776c

SHA1
cf47777eb72f05a189f46c0291af0d0a4d4ab516

SHA256
90d69f71c3994d221a4f67a94a3f179c3e28dab1050cfc1bdb357ee119168d0a

SHA512
80125e709da2804ed8cabdd11ffc97df7ad54195f0eda1edcf51afc45daf5aefd3894f857e8724a9039c2a956ad67a9cc84a0d1a66125fed8b1d8692234715dd

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcRCSlave7.exe

Filesize
464KB

MD5
b7bcfa586287f6629e8d98ccea1b8c81

SHA1
2035a01c1826e9cb6a724a623b654ec48df115cd

SHA256
a976f469d5f4dc0696da5965071732a0806f1e765cb2ee82be1ec164a8026920

SHA512
355eb59df8707ba6982b04a373c53381e81a942cb092b1e7b91a569eae6a85ee6e70f89aa1375ce38059952afa2862e6c7eef8be2ecc708f11075aca0d35a775

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcRCSlaveX7.exe

Filesize
355KB

MD5
891c7516138b4b9f5b71f381b1bf84f8

SHA1
8778dc2aa84d2d217c27acbcacf8d8b547aca43a

SHA256
1b38c5bed4fbdc559fbca348dfaa2bcc0c770ded201f90dffe89e3c8dd9a0215

SHA512
759f230d0fd97a63e41bb7be0bb7d180d461546c17828fa1130e5c303e51f48040275374a2fc9b1449fde35a86863dfc66ccbcd7713f9bfe77c3865148ca9a29

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcService7.exe

Filesize
526KB

MD5
d42b24baf04d8b8c0d9edbc234f3057c

SHA1
b1a56477837cba506de07fc4d00f661367ae28f3

SHA256
37495c517281cfe799bf84fe1d0329271b2601efddb6d9a672e413c60b11e71f

SHA512
e64ccfda399d0040e7701f102bc4ada0d80aec6be5177a88c33f760691f776b8f068ca07aaf049d8575cfa0c78d300667d1b73bee160442d134237ad4741ab37

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcSystem7.exe

Filesize
2.0MB

MD5
292f963989c7f714f13ee048a997f58c

SHA1
2d1c759a5232b179c369fcbef029eebe3efe0786

SHA256
2eced94a5df61791f29e3a1feaf1e75a0e652106124bcaed6eb68a52989af2a8

SHA512
a73b060ebca0a9ed76462c3a72b95730146dd9ef62b47cc6a26859a198f521854f4421c0a01bbc7aa5c87f6dcb79b69626444ca64973b5275c09044f626c9b26

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcUser7.exe

Filesize
597KB

MD5
11557104d8c38177334ee4f6af987e1b

SHA1
17e5a2086daaa13161fbfe82c0ee41ed2cdfa16b

SHA256
d209a46a7248a578fba4ccb38ac8f1adbe42673768e873eeab2834d2b0f53093

SHA512
c7c1dedfd94de3358a3a08a015928cd8cb501d50a2e90582608370db3ba7b7fc133e2b60a134250a838623639f3fed67c488c75b481c32f475a195923eac6603

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcWatermark7.exe

Filesize
434KB

MD5
0d48640ca10df777edfb5442d9602909

SHA1
62dd468f34c9926307e248903d9e60bb10b1f5b7

SHA256
665f257826ff8a8ccbb2ff8f8e059983926d4a7ab91d4a6e4dc0a50f6a01492f

SHA512
9b250e9fba3b8a6443685b8c597ec229edd162b93d623e109b31744d4498ce030044f2376374a1e92ca09937929815650e7b52ad4668c2abb2c2285e3fd14da9

Download Submit
C:\Users\Public\SMR7\WM7installTemp\wmcWatermark764.exe

Filesize
537KB

MD5
a3c9ba11fe917dbb52fa2858db5fcf11

SHA1
d8a57b91f4e80a1eb058dd6dc88c2cb9b0dce921

SHA256
f1f31da031d35b08edd4f47579bdb2a4a31842edd2a07603f8d3bcc9aa8662e8

SHA512
06ee2bec6b0fd23c6a510f6e3ac42248c46ecf003380da590520d467275a3dc3daf9676e9c7072ff5c13f0bb3fad6d960c5ec01f3768a876137097805b694986

Download Submit
C:\Windows\Debug\WM7\AutoUpdate\20240419.log

Filesize
974B

MD5
b710447bfbaafc6bdc47866d2ca87203

SHA1
1a803af6b7735d345ed5a659192cb9010343f341

SHA256
9c716d927b88f057827d78123a478f8b62bcca801c23f3db2a6b8b9f9cd85286

SHA512
1c792bf9fd7499add7663ea1c886d1c620750303468cf000159a9c01641f276f63224c6d6f6b3c3cdf47fb425f40522d45500027d623cffba9d42fc55729efce

Download Submit
C:\Windows\Debug\WM7\AutoUpdate\20240419.log

Filesize
1KB

MD5
4ff29fd9997fcaee699e5440aa8a6990

SHA1
620d3b154662bb6f011f32d1ee63b380cf50d81b

SHA256
35b88af4191dff3552c1ce3da1e3bd59b3b792aa4bca62d0f262b3de14554e39

SHA512
d43a6c92f3cfcc4b68bc46c518b0a7ffc2cb53038ce6cb39158687fe363663410ddc8fc22fb8aa8e96f1b154b1151de147230c53a3aefe95212a4c949f698614

Download Submit
C:\Windows\Debug\WM7\AutoUpdate\20240419.log

Filesize
1KB

MD5
ec631dae9b7109ec033c9901860ee8f4

SHA1
69c5581e4fc762b1b53325ca736710b19ef74c77

SHA256
2816a47cbaaff319c2648804220cc0c6e37add76a84486cf11495bf7c04e033b

SHA512
262004a4f05aa1db72f7b50b759edac390d024e5498e3c336cffa0c739c9967d4aea3b5adbc381509d5256f026023b3c2a797d9b0ba1450ba206d903dbde37ef

Download Submit
C:\Windows\Debug\WM7\AutoUpdate\20240419.log

Filesize
2KB

MD5
74f3c3b5cb555d17b8b8de99d1ca47bb

SHA1
9c47d49c5ab005a85ff6c9b2c3640aef2c271db8

SHA256
5497a36614ec87a0e75023e91c3e3997ef346f43afdcf9034d417b9b13797695

SHA512
bc4c6d2ddd93ffb290a256234ccecb9c022f51bfb46420eaa8d854244820a5c3d31b4df28287d233c7aecbdacd23c99fd20a8055541145a7b670ce3d79f24e49

Download Submit
C:\Windows\Debug\WM7\AutoUpdate\20240419.log

Filesize
4KB

MD5
b55924aa47df95d63256c5f12e203fd2

SHA1
a51c1038eb291e9ee67b69caa6bc1638e527ad48

SHA256
37dd165ca5921cd446c835038e9f7cac4356eeef0a99bf5306d5ed6dc1ff8f07

SHA512
e516ffe1dc065963d7ed50ad644721ae46358f384fa71dda1c6765899f45ee1866a4c34a74f09cc70a07d2ffea8ebc575bfc0e24dbe231ed730251cdd7438ff9

Download Submit
C:\Windows\Debug\WM7\AutoUpdate\20240419.log

Filesize
4KB

MD5
e37f639c14e6f6f483144361839da33d

SHA1
063d6400551d3d11386a0e364d3afb970647fa45

SHA256
2213694ca37c2597bd1a7bba32008a5607bff5660234b1c3116b107342ad5532

SHA512
de367be6ef559d5c2d0483e27ef59efabd8f4a41a4562ed5efd97d1a55a9f84537e4ca8be11b606efbd7a74a009974e2c99187f54b1a24c3bbc88bb14854ebea

Download Submit
C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240419.log

Filesize
704B

MD5
be06cb3aef270efc0a2804ee2d60f7e1

SHA1
75d6a841030a46b07d7df5ea9ce224a5c46d4b56

SHA256
2744e5912e36a1416b0fcb95e5b05178315c311acfe18abe3341ad06880472c4

SHA512
a2acdd6282ed7fdd7d620dbc36550667df04c69ed943b99b606ab420cf3518c87899e0eb6ca024234afec1e2973513555eb4e2fe2b86e67013f146af74ba0ca0

Download Submit
C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240419.log

Filesize
3KB

MD5
c49fe0c4895f16c1a3162f11a4921c82

SHA1
fc4d80dc5275f74dfa757d0de3695f50c360d1fd

SHA256
3e93f3aae53427de973d440c46242909cc9a22c325c7288f80c454f2499a48dd

SHA512
3f46f76be57b7a1b975cf468ca82f147954272675f74e984082c8376436ad92bf93436d4f4aaf5e71f49366269a83d3c9d32b24585a35378fec198f771bcb2a3

Download Submit
C:\Windows\Temp\{713CC6CE-B3E2-4fd9-838D-E28F558F6866}\cbregistryevtmsg.dll

Filesize
11KB

MD5
7241dcbab33ff2c6a3ea211e3f095be3

SHA1
3fd21f3b8bf054fe34324eba66f0e98ebe6d4bda

SHA256
4be5a326f9f4c07ea1e1df22f27a84aa197a54fab1928d05835f11505005d430

SHA512
66db36e8c4d37391115c6fb1300c1dbffddc84ef4d0db996c05c03687c2d0aa180a57e01be7d72ebffe80fca6fadba0f5e1bb01381065205ae5d476c5a9569b7

Download Submit
C:\Windows\Temp\{713CC6CE-B3E2-4fd9-838D-E28F558F6866}\x64\cbregistry20.sys

Filesize
110KB

MD5
1f6379ecb10624498a6955969cc1d77f

SHA1
8811d30255aceb2d622737a3e12229cc67f6d60e

SHA256
3817532a39d2bfac5445ef205e2c8700dc098c3d27d2fe812ba8608745e5605e

SHA512
2f2bd3be0bd01886c3f76d2a695e171f624139ea38a96b6789e0b400b6b5f7270fcae6e2ee07e82e5c45ddd47699f4e3fe3827a311ee731b79aeb7548c4698a3

Download Submit
C:\Windows\debug\SMR7\ScheduleTask\2024_04_19.log

Filesize
238B

MD5
6178bd5ac5bd31f29504adb0369d1cb1

SHA1
c8350155150d183f71a54115815da3fb6badb887

SHA256
6a9d34b39e36335dcc2d9e14da19325fb6333f98d584d3c705fa68b630dbd06e

SHA512
c1b24119b7a12ac5366f12128517d87eb5f502c8c5f0e0bc1e55c55666532938edba0c29576b0ccbc07cc66624551bd78fe9f14970d33fe1c1f5dcc4d3fff694

Download Submit
C:\Windows\debug\WM7\AutoUpdate\20240419.log

Filesize
3KB

MD5
87686b70b619a3b0a79f2cf1f6aee7e7

SHA1
a08d6f95f94d57d0fcdea55c723a2a90940f70b4

SHA256
9c6d8097bf3089fc03c70015731f44e6707edc818eb1cca37d4db10569bcb451

SHA512
93d10c568d91bea601b66d715e54b332783019a732893f699230793f5a34975ac2a92991441f07f10d28b5362c0c3a322d08dbc7f0bdeb0e54d937176413b652

Download Submit
C:\Windows\debug\WM7\AutoUpdate\20240419.log

Filesize
4KB

MD5
fd10a8fd958340bd4e72745153a99555

SHA1
b2a7780fd24d06096af4e0ffb0470c57ceb644e8

SHA256
eb6b86aebd4ce763e0a3a9358a224eafa9c4ff105aea842ddc53357668ac2416

SHA512
be07a6b1b442cd771c5190574bdb2632480fb0ed50b36d0d02e7d9f29b576514395ddcdeb1621a5ada3b8f348d8755ae9016ed789ecc1df4eb38ab5103dc97d1

Download Submit
C:\temp\Client.cab

Filesize
10.5MB

MD5
89eccc53fbd24fa1bc182e68d0dd95da

SHA1
a0efea13e5335233c9f3ad8b0a2c613e61b7f7c3

SHA256
e268f9f9c74059c6a236e0f3882837bffb210e4aa7397f6f472b8d4d79996317

SHA512
28bad6c3ea1a9bcd57193b8b45fdac011e5a98fb9ee75eaff42fb13a6c95d4d22544b382955eb1d45658f791bee69fb102c90ac62d8a31a3970d732c05c1aec7

Download Submit
C:\temp\PCScript.dat

Filesize
4KB

MD5
63f4a0e13e944299ae798cd1f56ec90c

SHA1
99b81e389865dacb659451fc8528c9e020266cf1

SHA256
8c99bad1abb544343da2ae64e1825fa7a02f07cc285e5bb7e636b4c050096256

SHA512
ebe44e5381045d8100bc9ad0e0cf2cc07bf326b771c13bebe6dc7f89ab98fb3558d8a220d2182ec57c0716d1a285daa88b0a6fabbf60e905761a00935edf59b5

Download Submit
C:\temp\PCScript.exe

Filesize
320KB

MD5
34bbef9a5afbf2df9c0b8c855d92d8cd

SHA1
17a0db61d635822c1be86ac71ca7360ff6315557

SHA256
dfbd22155b724a154063dfa90b7ee1f9d66435da6a7a1512a13ff3776d7b51ff

SHA512
3a3cbe7bb5f9f0c43bffc685e5bdb4b73af91e917fc426a0f24269cf12acd3a59afb8c04a0631f48d55108e256387d8b2d694d53c87a9a36fd05fc7b07072e37

Download Submit
C:\temp\PolicyContainer.opt

Filesize
7KB

MD5
83a1cde8a41ec9e2f9b1f3a3b47f8452

SHA1
2b0b03484927cc6aff72d6add3bf005e4b0ce550

SHA256
a0bdd89e7bdc14faf05a851e40963cf356a68dcd62f9404bf0091819370442f9

SHA512
91b792c488948ae92f8e3af0c900bb7519dc697d0cf938b7f32187c2841e56f796dc724b64971e9fec2b76536db440d6d8a0be6b38e287ee27bdfa210f4f3762

Download Submit
C:\temp\RemoteService.opt

Filesize
44B

MD5
21f084d77a7851f7bdc063d42edc02a9

SHA1
a018660ab7e63050facd2a9234bb739ae37dafe0

SHA256
594045032987458e03e396b7a40673138cb71ed175e9b71c2d29f8e31096c463

SHA512
82791e2b6ee4a14e8d408df0dcc4ba4102fd943e2bda5913e320f19d2b10ac0cd53b88a5e6bbc028b72f06a4958a21527d863bc568ec40709b56093a660737ce

Download Submit