b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

Reason

Machine shutdown

General

Target

RelievedkUtility.exe
Size

1.5MB
MD5

a6a0f7c173094f8dafef996157751ecf
SHA1

c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256

b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512

965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
SSDEEP

24576:mGIyixBMj+/A2d+UKnvT+LwZWj7iDDVVYrz0rbzGTw3DoA/sk6smE:mGbj+/BpKnvyIxVV/XDoAfmE

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Loads dropped DLL 3 IoCs

Processes:

RelievedkUtility.exe

pid process

3016 RelievedkUtility.exe
3016 RelievedkUtility.exe
3016 RelievedkUtility.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3016	RelievedkUtility.exe
3016	RelievedkUtility.exe
3016	RelievedkUtility.exe

Drops file in Program Files directory 64 IoCs

Processes:

RelievedkUtility.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	RelievedkUtility.exe
File created	C:\Program Files\7-Zip\7-zip.dll	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	RelievedkUtility.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

Processes:

RelievedkUtility.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	RelievedkUtility.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RelievedkUtility.exe

description pid process

Token: SeShutdownPrivilege 3016 RelievedkUtility.exe

description	pid	process
Token: SeShutdownPrivilege	3016	RelievedkUtility.exe

C:\Users\Admin\AppData\Local\Temp\RelievedkUtility.exe
"C:\Users\Admin\AppData\Local\Temp\RelievedkUtility.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2504

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
\Program Files\7-Zip\7zFM.exe

Filesize
935KB

MD5
d36deceeb4c9645aab2ded86608d090b

SHA1
912f4658c4b046fbadd084912f9126cb1ae3737b

SHA256
018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45

SHA512
9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

Download Submit
memory/2376-224-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2504-223-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors