5564abf832bcb92cefe7209cb8a583c462dbf8ab3652697634cd178324352616

Analysis

max time kernel
39s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uiso9_pe.exe
Size

4.9MB
MD5

b2eccdad91cbfebf99feaee03a9b789c
SHA1

7dffabe61b0ce856dd8afe014ff98d2b69f64099
SHA256

5564abf832bcb92cefe7209cb8a583c462dbf8ab3652697634cd178324352616
SHA512

c4daf6d9136a2753c29bb5d5f397fbf264d797f033cff565bb6d8dbd99d93619613064adc89bb1fde89333bc4c88f25596a584a173c2f32395bc52c4e698e368
SSDEEP

98304:dUjzlMXnScroy/f+SEUoJzDFs7i1wnSdcrRsMZtuS0xbN0yjqnolfIMPgZrx/Cp+:ajzlLy/BEUodDFs75nSdclsotcYyE9Mi

Score

4^/10

discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UltraISO\lang\is-GSRBL.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-TKHPL.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-7EGOE.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-MNCFN.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-KNSR5.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-V2FDA.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-JTPTA.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-Q5DAQ.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-D53IU.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-UG4CU.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-AU87J.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-I72VS.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-1GHB0.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-04JK0.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-THPBE.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-APILN.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-OSN7F.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-ELHO6.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-8NULH.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-OGECT.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-R52GN.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-N2QNI.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-1VD2U.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-IFK52.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-BCM8V.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-58ADF.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-1FQAM.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-LM0TQ.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-10EUO.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-1UE0O.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-C8EUN.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-MFUE0.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\unins000.dat	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-6QBFI.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-65V2D.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-RNUQ5.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-3RSU0.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-M4L27.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-GRNJG.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-64ARG.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-VPEPM.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-9JELA.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-16B84.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-C5ERV.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-EE40E.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-DDJNQ.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-I5257.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-9HVOG.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-5RR3G.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\Common Files\EZB Systems\is-TU82R.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\is-MTP8D.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-6S5P6.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-UVQNA.tmp	uiso9_pe.tmp
File opened for modification	C:\Program Files (x86)\UltraISO\backup	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-AKT6N.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-F08SF.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\drivers\is-KF7N6.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-HGH9L.tmp	uiso9_pe.tmp
File created	C:\Program Files (x86)\UltraISO\lang\is-4GEBJ.tmp	uiso9_pe.tmp
File opened for modification	C:\Program Files (x86)\UltraISO\unins000.dat	uiso9_pe.tmp

Executes dropped EXE 3 IoCs

pid	Process
3460	uiso9_pe.tmp
1176	isocmd.exe
928	UltraISO.exe

Loads dropped DLL 2 IoCs

pid	Process
5008	regsvr32.exe
928	UltraISO.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\0\win64	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers\ISOShell\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\CLSID\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ = "IUIContextMenu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\DefaultIcon\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\",0"	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\""	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\DefaultIcon	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ui\ = "UltraISO"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\0\win64\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\open	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers\ISOShell\ = "{AD392E40-428C-459F-961E-9B147782D099}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\ = "UltraISO File"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\DefaultIcon	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\ = "BIN File"	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib\ = "{1CD46142-F3D3-4E46-87BA-7CC019142F9D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\DefaultIcon\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\",0"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\command	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\Convert to ISO\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" -bin2iso \"%1\""	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UltraISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\ = "ISOShell 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\UltraISO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ui	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\ = "Open with &UltraISO"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bin	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ = "IUIContextMenu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz\ = "UltraISO"	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\ = "UIContextMenu Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ = "UIContextMenu Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\""	uiso9_pe.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bin\ = "binimage"	uiso9_pe.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\Convert to ISO\command	uiso9_pe.tmp

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3200	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3200	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3460	uiso9_pe.tmp

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 3460	1736	uiso9_pe.exe	81
PID 1736 wrote to memory of 3460	1736	uiso9_pe.exe	81
PID 1736 wrote to memory of 3460	1736	uiso9_pe.exe	81
PID 3460 wrote to memory of 5008	3460	uiso9_pe.tmp	91
PID 3460 wrote to memory of 5008	3460	uiso9_pe.tmp	91
PID 3460 wrote to memory of 1176	3460	uiso9_pe.tmp	92
PID 3460 wrote to memory of 1176	3460	uiso9_pe.tmp	92
PID 3460 wrote to memory of 1176	3460	uiso9_pe.tmp	92
PID 3460 wrote to memory of 928	3460	uiso9_pe.tmp	95
PID 3460 wrote to memory of 928	3460	uiso9_pe.tmp	95
PID 3460 wrote to memory of 928	3460	uiso9_pe.tmp	95

C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe
"C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\is-B9PTT.tmp\uiso9_pe.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-B9PTT.tmp\uiso9_pe.tmp" /SL5="$8004C,4648088,128512,C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:5008
- - C:\Program Files (x86)\UltraISO\drivers\isocmd.exe
    "C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -i
    3⤵
    - Executes dropped EXE
    PID:1176
- - C:\Program Files (x86)\UltraISO\UltraISO.exe
    "C:\Program Files (x86)\UltraISO\UltraISO.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x3c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\EZB Systems\lame_enc.dll

Filesize
962KB

MD5
b9e34ae6d6ecb1e19b36dc70e7ef406c

SHA1
014985ed2dab57e606e08788fc9177220dd2aed1

SHA256
3b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4

SHA512
d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2

Download Submit
C:\Program Files (x86)\UltraISO\UltraISO.exe

Filesize
5.3MB

MD5
19357305245657a41e9551431c8ae18a

SHA1
e34f08240fbb20bb3a56b03fd49c7ff71c9bba60

SHA256
f89e9d336c6f49fbd847ea513a11bb1bfa80ea5fd1336e23cad7d80370baea65

SHA512
6dcf2eb31976295ba9e381e2af69900aa383d1d265c2c2c38e99a048a0dd1d378569eae0f464e82864f839ae82ec75216d15917dd467016df527843eff85af27

Download Submit
C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys

Filesize
132KB

MD5
bc81814b594286bef9913ec5ca1110d7

SHA1
523fc3b657fd3fb493e0fb14c0bbf39813d1e558

SHA256
9c22b6f77e929d319c5e891ee1510045dc5f486bdaf47a0696564d4d84d30379

SHA512
2b65dc57a4c83c1ef243396dabf15cf53faa145bd073ac89dbf9104519e7a2b97a303c96acfdbc992e9ac19efbe65b143dd27bb6c9f7ad3e76c5eacb1b9a1889

Download Submit
C:\Program Files (x86)\UltraISO\drivers\IsoCmd.exe

Filesize
28KB

MD5
55677a521dd34ce7a93ab3f1d12b2dfd

SHA1
4316dd2b5e4ebb48886955ec5365b2f40d4298b3

SHA256
fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c

SHA512
e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc

Download Submit
C:\Program Files (x86)\UltraISO\isoshl64.dll

Filesize
151KB

MD5
c0fc6c67bd9d9fbc4f8ad44232d49d11

SHA1
e5ad2b56cc20652401ee5c60fe118cf3fb474a7b

SHA256
50df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503

SHA512
74bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-B9PTT.tmp\uiso9_pe.tmp

Filesize
771KB

MD5
3de2992c86c78e781881e9c0db26a32f

SHA1
c26845ca7319a66432304a955cecdad4f977d040

SHA256
e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642

SHA512
88d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6

Download Submit
memory/1736-2-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/1736-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1736-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1736-159-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3460-6-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3460-158-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3460-13-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3460-9-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads