d58e89fb349366c78287a046823e7392261ca8d6d9b0e93c9a867308986b4398

General

Target

WinDjView.exe
Size

1.6MB
MD5

af976095d656221e4004791ec4c57d61
SHA1

11e818c53098cf17ac8cece9e92fd8f26ac7e3d9
SHA256

c86aeee03608384226cbb98db0c92050b45b9538ddaf2be4528e5961a5078dcd
SHA512

83407089de986726a0819ce755b8e2b44a9bd0ed71d0eb2fb62db863aa004ed931e3cb076c445342ea5d201c4818265cd7ceff387e97dab97a787119782bacc0
SSDEEP

24576:Q+lcwLUkgAoNQAx3uMU67k4+Nm4ctzTVzK827rUJjqlKsSZuT:R7gy6X+EzA827Y8lK5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\ddeexec\ = "[open(\"%1\")]"	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\ddeexec\IfExec	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.djv	WinDjView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\ = "DjVu Document"	WinDjView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinDjView.exe,0"	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\ddeexec\Application	WinDjView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\ddeexec\Topic\ = "System"	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.djvu	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\DefaultIcon	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open	WinDjView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\ddeexec\Application\ = "WinDjView"	WinDjView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\ddeexec\IfExec\ = "[rem open]"	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\command	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\ddeexec	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell	WinDjView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinDjView.exe\" \"%1\""	WinDjView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.djvu\ = "DjVu.Document"	WinDjView.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.djv\ = "DjVu.Document"	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document	WinDjView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DjVu.Document\shell\open\ddeexec\Topic	WinDjView.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1020	WinDjView.exe
1020	WinDjView.exe
1020	WinDjView.exe
1020	WinDjView.exe
1020	WinDjView.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4612	1020	WinDjView.exe	102
PID 1020 wrote to memory of 4612	1020	WinDjView.exe	102

C:\Users\Admin\AppData\Local\Temp\WinDjView.exe
"C:\Users\Admin\AppData\Local\Temp\WinDjView.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://windjview.sourceforge.net/
  2⤵
  PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4304,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3624,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
1⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4324,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
1⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5448,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
1⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5692,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
1⤵
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5492,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
1⤵
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5508,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads