5564abf832bcb92cefe7209cb8a583c462dbf8ab3652697634cd178324352616

Analysis

max time kernel
22s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uiso9_pe.exe
Size

4.9MB
MD5

b2eccdad91cbfebf99feaee03a9b789c
SHA1

7dffabe61b0ce856dd8afe014ff98d2b69f64099
SHA256

5564abf832bcb92cefe7209cb8a583c462dbf8ab3652697634cd178324352616
SHA512

c4daf6d9136a2753c29bb5d5f397fbf264d797f033cff565bb6d8dbd99d93619613064adc89bb1fde89333bc4c88f25596a584a173c2f32395bc52c4e698e368
SSDEEP

98304:dUjzlMXnScroy/f+SEUoJzDFs7i1wnSdcrRsMZtuS0xbN0yjqnolfIMPgZrx/Cp+:ajzlLy/BEUodDFs75nSdclsotcYyE9Mi

Score

4^/10

discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UltraISO\lang\is-VTUAE.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-K5BRG.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-3UJ13.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-3D19D.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-PMFJN.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-FT6JN.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-70A2A.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-N4I72.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-L2FL5.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-5PT1A.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-TPIJL.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-CCLKK.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-130AS.tmp	uiso9_pe.tmp
File opened for modification	C:\Program Files (x86)\UltraISO\backup	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-0EHGB.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-H80UG.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-4APQ5.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-Q70VQ.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-Q5Q9S.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-1EB47.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-AHGPF.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-TV1NL.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-J59NI.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-94H19.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-567IT.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-24MOP.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-JMQVD.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-O6TNV.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-M5CEH.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-RHL58.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-428RP.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\unins000.dat	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-4TV1M.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-8VG0P.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-92HKR.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-BONSA.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-K897D.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-9A3C2.tmp	uiso9_pe.tmp
File opened for modification	C:\Program Files (x86)\UltraISO\unins000.dat	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-UNV6V.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-VA7F5.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-UN2N0.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-Q46VJ.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-1UA7V.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-0DBTL.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-TNLQ5.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\Common Files\EZB Systems\is-IL837.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-UJQ47.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-SHGKU.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-B96V3.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-IE56Q.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-I2V19.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-DL8F7.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-MS7N2.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-B6T7D.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-L88SE.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-PUOII.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-KFT9V.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-04K91.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-07TGD.tmp	uiso9_pe.tmp

Executes dropped EXE 3 IoCs

pid	Process
3060	uiso9_pe.tmp
2168	isocmd.exe
1688	UltraISO.exe

Loads dropped DLL 9 IoCs

pid	Process
1936	uiso9_pe.exe
3060	uiso9_pe.tmp
3060	uiso9_pe.tmp
3060	uiso9_pe.tmp
1740	regsvr32.exe
3060	uiso9_pe.tmp
3060	uiso9_pe.tmp
3060	uiso9_pe.tmp
1688	UltraISO.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\command	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\""	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bin\ = "binimage"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers\ISOShell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\0\win64\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\ = "UltraISO File"	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\ = "Open with &UltraISO"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\open\command	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers\ISOShell\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz\ = "UltraISO"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bin	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\ = "BIN File"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\ = "ISOShell 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ = "IUIContextMenu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ = "IUIContextMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\open	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CurVer\ = "ISOShell.UIContextMenu.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\DefaultIcon\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\",0"	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\""	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\ = "UIContextMenu Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\VersionIndependentProgID\ = "ISOShell.UIContextMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\UltraISO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso\ = "UltraISO"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\DefaultIcon	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UltraISO	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers\ISOShell\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ = "UIContextMenu Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\TypeLib\ = "{1CD46142-F3D3-4E46-87BA-7CC019142F9D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\DefaultIcon\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\",0"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\DefaultIcon	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\Convert to ISO\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" -bin2iso \"%1\""	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\Convert to ISO	uiso9_pe.tmp

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
484	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	uiso9_pe.tmp

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3060	1936	uiso9_pe.exe	28
PID 1936 wrote to memory of 3060	1936	uiso9_pe.exe	28
PID 1936 wrote to memory of 3060	1936	uiso9_pe.exe	28
PID 1936 wrote to memory of 3060	1936	uiso9_pe.exe	28
PID 1936 wrote to memory of 3060	1936	uiso9_pe.exe	28
PID 1936 wrote to memory of 3060	1936	uiso9_pe.exe	28
PID 1936 wrote to memory of 3060	1936	uiso9_pe.exe	28
PID 3060 wrote to memory of 1740	3060	uiso9_pe.tmp	29
PID 3060 wrote to memory of 1740	3060	uiso9_pe.tmp	29
PID 3060 wrote to memory of 1740	3060	uiso9_pe.tmp	29
PID 3060 wrote to memory of 1740	3060	uiso9_pe.tmp	29
PID 3060 wrote to memory of 1740	3060	uiso9_pe.tmp	29
PID 3060 wrote to memory of 1740	3060	uiso9_pe.tmp	29
PID 3060 wrote to memory of 1740	3060	uiso9_pe.tmp	29
PID 3060 wrote to memory of 2168	3060	uiso9_pe.tmp	30
PID 3060 wrote to memory of 2168	3060	uiso9_pe.tmp	30
PID 3060 wrote to memory of 2168	3060	uiso9_pe.tmp	30
PID 3060 wrote to memory of 2168	3060	uiso9_pe.tmp	30
PID 3060 wrote to memory of 1688	3060	uiso9_pe.tmp	33
PID 3060 wrote to memory of 1688	3060	uiso9_pe.tmp	33
PID 3060 wrote to memory of 1688	3060	uiso9_pe.tmp	33
PID 3060 wrote to memory of 1688	3060	uiso9_pe.tmp	33

C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe
"C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\is-M7Q0F.tmp\uiso9_pe.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M7Q0F.tmp\uiso9_pe.tmp" /SL5="$4010A,4648088,128512,C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:1740
- - C:\Program Files (x86)\UltraISO\drivers\isocmd.exe
    "C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2168
- - C:\Program Files (x86)\UltraISO\UltraISO.exe
    "C:\Program Files (x86)\UltraISO\UltraISO.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys

Filesize
112KB

MD5
e489d12ff435aeef4a5474c47d329590

SHA1
17c353b5748ecd3e8eedd9de347da313085087dc

SHA256
66a01f63ee4f66c0cd5bb9bf20e1722d57cc8252ac126780800806b536f4cea9

SHA512
26582a140080e64d7f46b83435a8f2444c509e6a5dfaa1fd4adc190824daecfc5464e56ca89cb0518bcec780a1a16700199e567543cea32f32c5ca3e47add2fc

Download Submit
C:\Program Files (x86)\UltraISO\isoshl64.dll

Filesize
151KB

MD5
c0fc6c67bd9d9fbc4f8ad44232d49d11

SHA1
e5ad2b56cc20652401ee5c60fe118cf3fb474a7b

SHA256
50df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503

SHA512
74bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586

Download Submit
\Program Files (x86)\Common Files\EZB Systems\lame_enc.dll

Filesize
962KB

MD5
b9e34ae6d6ecb1e19b36dc70e7ef406c

SHA1
014985ed2dab57e606e08788fc9177220dd2aed1

SHA256
3b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4

SHA512
d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2

Download Submit
\Program Files (x86)\UltraISO\UltraISO.exe

Filesize
5.3MB

MD5
19357305245657a41e9551431c8ae18a

SHA1
e34f08240fbb20bb3a56b03fd49c7ff71c9bba60

SHA256
f89e9d336c6f49fbd847ea513a11bb1bfa80ea5fd1336e23cad7d80370baea65

SHA512
6dcf2eb31976295ba9e381e2af69900aa383d1d265c2c2c38e99a048a0dd1d378569eae0f464e82864f839ae82ec75216d15917dd467016df527843eff85af27

Download Submit
\Program Files (x86)\UltraISO\drivers\IsoCmd.exe

Filesize
28KB

MD5
55677a521dd34ce7a93ab3f1d12b2dfd

SHA1
4316dd2b5e4ebb48886955ec5365b2f40d4298b3

SHA256
fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c

SHA512
e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc

Download Submit
\Program Files (x86)\UltraISO\unins000.exe

Filesize
782KB

MD5
f92f7190cab7f80cbd7f5e419c27e37d

SHA1
8b26411b33a8727353ac615c11acdfebc34fad80

SHA256
82190e1bfe62f4549f3ca2dd76261cc6213968d4f599349d3b07274499223ece

SHA512
922ead325d49738ecd3ad93aec573649da5a9082892aeeb63cfdaa0f0c5141844a86bae666b3279303b0b1684e93433b62f734c52c77c94633bd6a508f7480dc

Download Submit
\Users\Admin\AppData\Local\Temp\is-M7Q0F.tmp\uiso9_pe.tmp

Filesize
771KB

MD5
3de2992c86c78e781881e9c0db26a32f

SHA1
c26845ca7319a66432304a955cecdad4f977d040

SHA256
e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642

SHA512
88d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6

Download Submit
memory/1936-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1936-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1936-165-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1936-2-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/3060-11-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3060-8-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3060-164-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads