aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a

General

Target

aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Size

1.6MB
MD5

e55898a4097ae66f15de014979a28d41
SHA1

8249370d601bbce1bf5f8212b89789d68fbeadfc
SHA256

aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a
SHA512

d35d91887c823fba2446eb0327d0c5dfa07823fab2a068e35f2c38bae37dd5ae8686710219b41d2c6e982d07d942b607c7f8dd6ee7b4279635193ba90f6a54e7
SSDEEP

24576:GJInb1K2o7Ob8A2SVI5uTOc0k6qc1RxV7e/1mV04OJuGucMLriG:i742k6hEohStM3P

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.INI	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
File opened for modification	C:\Windows\SCtrlSet2.bin	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
File created	C:\Windows\SCtrlSet2.bin	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	1984	WerFault.exe	27

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\classes\SoftContrl2	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\SoftContrl2\SoftCtrlSet = a3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1aaa3a4a1c7a1f1a1c5bfc9a1eda1f2a1ada1e6a1f82eeef894bbc6532e8ba3aca3a8a6ebbfcad5c6b5e7babac1ecc4eea3a1a3a3a2b8a1a8a3a4a1d9a1f1a1dbbfc9a10d77c8c7aca1e6a1f22eeef894bbc653	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Chinotes.Document\shell\open\command	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Chinotes.Document\shell	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Chinotes.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe %1"	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gb\ = "Chinotes.Document"	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Chinotes.Document	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Chinotes.Document\ = "Chinotes Document"	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Chinotes.Document\shell\open	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1984	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
1984	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
1984	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2572	1984	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe	28
PID 1984 wrote to memory of 2572	1984	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe	28
PID 1984 wrote to memory of 2572	1984	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe	28
PID 1984 wrote to memory of 2572	1984	aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe	28

C:\Users\Admin\AppData\Local\Temp\aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe
"C:\Users\Admin\AppData\Local\Temp\aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 284
  2⤵
  - Program crash
  PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\aa77f6149387a1dd0b4e319fe14a1a3f78f69f5ef1c1536be7e9b2f3225a869a.INI

Filesize
30B

MD5
797fa9bbad9a5760738731e784b3d7e9

SHA1
5127fca4b5ec060508b571a320503249b8dc5446

SHA256
4af63b84eab275ae869d483d665194f67724e35147e47954ffefe71376dbae72

SHA512
f35ce45cb1109ce2f403ea421684e83966cc335edc0f7edd9fad112b42295b9e2510c252ed4e9c61bd383a72ae9825ed166c08fb3405b22780814c926131ec5c

Download Submit

Analysis

Sharing