b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

General

Target

RelievedkUtility.exe
Size

1.5MB
MD5

a6a0f7c173094f8dafef996157751ecf
SHA1

c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256

b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512

965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
SSDEEP

24576:mGIyixBMj+/A2d+UKnvT+LwZWj7iDDVVYrz0rbzGTw3DoA/sk6smE:mGbj+/BpKnvyIxVV/XDoAfmE

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Loads dropped DLL 2 IoCs

Processes:

pid process

3284
3284
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3284
3284

Drops file in Program Files directory 64 IoCs

Processes:

RelievedkUtility.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	RelievedkUtility.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	RelievedkUtility.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

Processes:

RelievedkUtility.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	RelievedkUtility.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RelievedkUtility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	RelievedkUtility.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RelievedkUtility.exe

pid process

2404 RelievedkUtility.exe

pid	process
2404	RelievedkUtility.exe

C:\Users\Admin\AppData\Local\Temp\RelievedkUtility.exe
"C:\Users\Admin\AppData\Local\Temp\RelievedkUtility.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
PID:4904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:828

C:\Users\Admin\AppData\Local\Temp\RelievedkUtility.exe
"C:\Users\Admin\AppData\Local\Temp\RelievedkUtility.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\7-Zip\7-zip.dll
Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit

Analysis

Sharing