2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
Size

320KB
MD5

bca6144a6b4042fa542cc789b02423b3
SHA1

bc0d9ee6ee0244b86466b4f1c0511c06386a3bb3
SHA256

2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1
SHA512

780e14bef0e47a3cfe8561e26268ffa0b4b34beb472f9c606160ac60ebe9f093832df0f1f194ba34a3afefefea44abb55f003e5066174342bd822ee1407003af
SSDEEP

6144:heHwXUU5EYCTvaBjRjWrLJKuKnGML5NjcxFSH:hyMUusvalgg5NjaFSH

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\GPV3W6L\\TLR5E3K.exe\""	system.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\GPV3W6L\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe

Executes dropped EXE 5 IoCs

pid	Process
5152	service.exe
5556	smss.exe
5780	system.exe
5320	winlogon.exe
220	lsass.exe

Loads dropped DLL 3 IoCs

pid	Process
5780	system.exe
5780	system.exe
5780	system.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023269-129.dat	upx
behavioral2/memory/5780-298-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sPV6J8P0 = "C:\\Windows\\system32\\VQO2V7QRWI0E1C.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0E3KWI = "C:\\Windows\\MOY6J8P.exe"	system.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\H:	service.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\VQO2V7QRWI0E1C.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\VQO2V7QRWI0E1C.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\EDH6M5W.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\VQO2V7QRWI0E1C.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T\VQO2V7Q.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T	system.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T\VQO2V7Q.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T\VQO2V7Q.cmd	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T\VQO2V7Q.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\EDH6M5W.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T	smss.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\VQO2V7QRWI0E1C.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T\VQO2V7Q.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\EDH6M5W.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\SysWOW64\VQO2V7QRWI0E1C.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\EDH6M5W.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\SysWOW64\EDH6M5W.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\EDH6M5W.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\VQO2V7QRWI0E1C.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\NFG6K7T\VQO2V7Q.cmd	service.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\GPV3W6L\service.exe	system.exe
File opened for modification	C:\Windows\GPV3W6L\JMJ6N4G.com	service.exe
File opened for modification	C:\Windows\moonlight.dll	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\GPV3W6L	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\GPV3W6L\service.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\GPV3W6L\JMJ6N4G.com	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\cypreg.dll	winlogon.exe
File opened for modification	C:\Windows\MOY6J8P.exe	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\GPV3W6L\winlogon.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\RWI0E1C.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\GPV3W6L\TLR5E3K.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\GPV3W6L\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\GPV3W6L\winlogon.exe	smss.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\GPV3W6L\TLR5E3K.exe	smss.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\GPV3W6L\service.exe	smss.exe
File opened for modification	C:\Windows\lsass.exe	smss.exe
File created	C:\Windows\MooNlight.txt	smss.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\GPV3W6L	lsass.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\RWI0E1C.exe	winlogon.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\GPV3W6L\JMJ6N4G.com	system.exe
File opened for modification	C:\Windows\GPV3W6L	service.exe
File opened for modification	C:\Windows\GPV3W6L\system.exe	service.exe
File opened for modification	C:\Windows\GPV3W6L\system.exe	system.exe
File opened for modification	C:\Windows\GPV3W6L\TLR5E3K.exe	winlogon.exe
File opened for modification	C:\Windows\GPV3W6L\JMJ6N4G.com	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\moonlight.dll	service.exe
File opened for modification	C:\Windows\GPV3W6L	winlogon.exe
File opened for modification	C:\Windows\GPV3W6L\service.exe	service.exe
File opened for modification	C:\Windows\GPV3W6L\smss.exe	service.exe
File opened for modification	C:\Windows\MOY6J8P.exe	smss.exe
File opened for modification	C:\Windows\RWI0E1C.exe	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\GPV3W6L\regedit.cmd	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\GPV3W6L\smss.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\MOY6J8P.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File opened for modification	C:\Windows\lsass.exe	winlogon.exe
File opened for modification	C:\Windows\GPV3W6L\service.exe	winlogon.exe
File opened for modification	C:\Windows\GPV3W6L\smss.exe	winlogon.exe
File opened for modification	C:\Windows\GPV3W6L\smss.exe	lsass.exe
File opened for modification	C:\Windows\RWI0E1C.exe	lsass.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\lsass.exe	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
File opened for modification	C:\Windows\GPV3W6L\winlogon.exe	service.exe
File opened for modification	C:\Windows\GPV3W6L\JMJ6N4G.com	smss.exe
File opened for modification	C:\Windows\RWI0E1C.exe	service.exe
File opened for modification	C:\Windows\GPV3W6L\JMJ6N4G.com	winlogon.exe
File opened for modification	C:\Windows\GPV3W6L\winlogon.exe	system.exe
File opened for modification	C:\Windows\GPV3W6L\TLR5E3K.exe	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2040	5780	WerFault.exe	93
4664	5780	WerFault.exe	93
2720	5780	WerFault.exe	93

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
5152	service.exe
5556	smss.exe
5320	winlogon.exe
5780	system.exe
220	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 5152	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	91
PID 3544 wrote to memory of 5152	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	91
PID 3544 wrote to memory of 5152	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	91
PID 3544 wrote to memory of 5556	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	92
PID 3544 wrote to memory of 5556	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	92
PID 3544 wrote to memory of 5556	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	92
PID 3544 wrote to memory of 5780	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	93
PID 3544 wrote to memory of 5780	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	93
PID 3544 wrote to memory of 5780	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	93
PID 3544 wrote to memory of 5320	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	94
PID 3544 wrote to memory of 5320	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	94
PID 3544 wrote to memory of 5320	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	94
PID 3544 wrote to memory of 220	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	95
PID 3544 wrote to memory of 220	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	95
PID 3544 wrote to memory of 220	3544	2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe	95

C:\Users\Admin\AppData\Local\Temp\2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe
"C:\Users\Admin\AppData\Local\Temp\2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\GPV3W6L\service.exe
  "C:\Windows\GPV3W6L\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5152
- C:\Windows\GPV3W6L\smss.exe
  "C:\Windows\GPV3W6L\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5556
- C:\Windows\GPV3W6L\system.exe
  "C:\Windows\GPV3W6L\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 1176
    3⤵
    - Program crash
    PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 1380
    3⤵
    - Program crash
    PID:4664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 1384
    3⤵
    - Program crash
    PID:2720
- C:\Windows\GPV3W6L\winlogon.exe
  "C:\Windows\GPV3W6L\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5320
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5780 -ip 5780
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5780 -ip 5780
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5780 -ip 5780
1⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\GPV3W6L\TLR5E3K.exe

Filesize
320KB

MD5
e4f171c33bf9e083749633d1ab530b9d

SHA1
f63d22d478174cb048d5fb37815e8ce0929cfd54

SHA256
b2d4b9777fb7987e314b8963b575bb5425b23f699acea605da608af90cd020ef

SHA512
6ff64c3f7b15482eda8349d974cea72b66f1b5de79a4f43a8b29d4f08ef52e2124e5983e494b6fdacd1915d39626aaa25101713f320f883f2c544b6bb94c0a1a

Download Submit
C:\Windows\GPV3W6L\TLR5E3K.exe

Filesize
320KB

MD5
0efde016e22ef0a1f98f5c655c6a2454

SHA1
9f0f969dba41f0ee1d4599119a963e9a2e7d4f0e

SHA256
fa8b2878233e59c7f135445fd47640c757825f4f5242b06cca556f4ab7479c80

SHA512
6596520708c6c458b3911de2e67e1ef80df090cdcade865ee05aaebec207c0c8b377258118351a424b0ba084b6ba49fdc70aa8296323b7602dd9fe8130912241

Download Submit
C:\Windows\GPV3W6L\TLR5E3K.exe

Filesize
320KB

MD5
b2278bd52eae50d9f3db7c866da1495b

SHA1
e9efa5cb76e80300abf82688dbbf120fb52b10c8

SHA256
c68b77d96fdf0976c22bfdf728ad41ac19e7ab30a381670918b9f18ff60344be

SHA512
9733a475de7df5e6892f88db0c8ab9727463cf09cf67d6c463d1c706419395fa5054463ca47401e1beb0ac46468bd28312690c5cd8faa8042b7fd208864ee2d2

Download Submit
C:\Windows\GPV3W6L\TLR5E3K.exe

Filesize
320KB

MD5
e3f47af366fe8b294271bd45835590aa

SHA1
62ea89a5f12ff41f7976799cdd473e20e3b6cb5b

SHA256
a5d140f7ce772e52e6aac482772366276eba8c99f5c57889ee88e6d52ef4e419

SHA512
7f06f560af997fcee100328b0e9f4cad360b03fc3eee5c2cc7faed2271a3c4128aae96a26b3bbf223342b9ca2a20accd8ed5a2c8b3c02bce269499b01c0714bb

Download Submit
C:\Windows\GPV3W6L\regedit.cmd

Filesize
320KB

MD5
db8da31cc69759762e6fbba68437f671

SHA1
207888eee06201a8df834c464e2db133824fefd2

SHA256
e0bb3005c2fb230029777e3669f76c2f68acc830d523f6cf39e96b5a64c43718

SHA512
d5b3916c62d778733fca700b4718e275ed0b3745176cff2e5e5da6236edd41bfe202e5be5f168c48204b38e364d63837299b2d9134a40920a1ac9e61de83826c

Download Submit
C:\Windows\GPV3W6L\regedit.cmd

Filesize
320KB

MD5
7a6cc758e29f27cfc5b2636a232faa4e

SHA1
a08669b024dee550d768eb2523c9de887df30806

SHA256
cfe28dd799cbad340896691654044f2d2a423d755607c11f87195fe2b9e87c76

SHA512
c0bc5f2ce64b4ce231bc8efe378b533efe508568645b157208e830a897c138ddbe780260f69451be8369f9ce2f75261c3cd58c11df70ccdb3201f2489b83d4ec

Download Submit
C:\Windows\GPV3W6L\regedit.cmd

Filesize
320KB

MD5
67bc55d6b1d7cb240b7d186cc3eedb93

SHA1
e882de0d6aa0f94e491eb1358f3667a2e179bba4

SHA256
ed8666a9f7d78efa1ab37ab0bfe3ad36e5cb425f352f05fb1ac62639e802d355

SHA512
7bb8bd655287630b5548877a9ad4ce4a1e4fd2244493f642be89375c3c9190862be55fd745fb330d8e71a24088516d8f2ebb3e098b16218029e60babdeca35d4

Download Submit
C:\Windows\GPV3W6L\regedit.cmd

Filesize
320KB

MD5
4382067c485336e0470e2852635fce71

SHA1
06c45163f9c282448a2ace8de449db87ff45298d

SHA256
8fefeb25ef15aac4a7aec6a7943f869ad9cb8992bdc85507fe36ea220305b8d8

SHA512
a1be53e6033533263b4a1830156ab7ce83aa148c5149cd9829bc400eb947293974f85b88930e0abf7f29e19fc4377e5c5582c90f470f72b2c907f3fe57a3b76d

Download Submit
C:\Windows\GPV3W6L\service.exe

Filesize
320KB

MD5
bca6144a6b4042fa542cc789b02423b3

SHA1
bc0d9ee6ee0244b86466b4f1c0511c06386a3bb3

SHA256
2d599a3d6c0d8d45802f7fb6de2500422cc9d9272ee976f590f5c575fc9c46e1

SHA512
780e14bef0e47a3cfe8561e26268ffa0b4b34beb472f9c606160ac60ebe9f093832df0f1f194ba34a3afefefea44abb55f003e5066174342bd822ee1407003af

Download Submit
C:\Windows\GPV3W6L\smss.exe

Filesize
320KB

MD5
20e26acff14650df6a0d8a1969bda998

SHA1
0ed2f1dd6f9b5440d54bfcb9a747a68e74a48ec2

SHA256
c96275e35432063076716ce909aa7c25dff7d0a0d64972fa1d51b389e61b691d

SHA512
b40b03084f895e6660f28be7dff5afa39df0977a572c7e12113bb7e0a1727d504fbc145b74d5c8be0817a23684a36fdaf708db701501c19bd6235a7105d8860e

Download Submit
C:\Windows\GPV3W6L\system.exe

Filesize
320KB

MD5
4a6280bdb375dea31803246271e30b32

SHA1
7d76b5e1bdc723e1455bbdf6cfed2d97668ca638

SHA256
329d0c6f832e5b3bef9c108f8046e84d0ee9698a2c9f955e18a75f04b7f8bcd4

SHA512
cf5ccf5c38049d19c591a4f1c7f0605cc95b8e6284b06a27257941185bd96659e0f54fb5d3c8d5b0675c8ce8d3c1102b53c218863296a6dd30ae8ff5e4bb2635

Download Submit
C:\Windows\GPV3W6L\winlogon.exe

Filesize
320KB

MD5
9b5086ba3d41385e6d35954633c1c2ef

SHA1
6fe9a18cfcf83b8ac58c4dba49c47f1c5c1b5514

SHA256
3fea766416a537dc0a4e3b1f7d1780de85645c26316e69decdfa67c1ff48bdfe

SHA512
53bd3ca0b00c1b372e61fc793fac587ed16ec98832acf8ff927f2776bac3d11b2fbfa7c04ed7c1289e3d7c0bede7d708ecb96fa11cfd8edbe8cdf58676ceaadd

Download Submit
C:\Windows\MOY6J8P.exe

Filesize
320KB

MD5
22f386a76b90a9b557dec656aa3ac61f

SHA1
63d49cf4d25a605271a3a098a0412cb7cd2c6967

SHA256
850a5ce24129972d43a8592fcadf4171378f801f413f41fa292000b2940f0aeb

SHA512
333c89cf3f5da4b6764728e4febd702c7ef41345952eae699ea32b33276dd4246e5d617f5747872dffbceedd0c85d25a431351e789abea3f7da8f0f998fadee3

Download Submit
C:\Windows\MOY6J8P.exe

Filesize
320KB

MD5
f7b71873f0e92da5b9ea819ec70476da

SHA1
82803cc5c67684e2709d73a0ddc1f0161239c937

SHA256
4b149ebcb040e0df9dd3f468eec426a228f9f67cd94d30c3437f1ba0224acf66

SHA512
3e0fbbcc4edbaab6ca3ed69ee6c6329a767ccd6cf3432379b6036cce70b8fc47c95c463cb5443e1b3ed885588ec78dfa890259fc03f015a1514942a2d648cae4

Download Submit
C:\Windows\RWI0E1C.exe

Filesize
320KB

MD5
4ac8107e905fc6a165e464d0464e3ef5

SHA1
bc0f895e54816997549edb6cdfedb27c90042fbe

SHA256
2efbd1a4e8db2e4bd1aec8a45f332422d60e8744f6acc31434c7882e4857da1a

SHA512
266ec78bdcf304338b172258d16d8ce2287e36ce3a3473eb1e36e3493af64748ec6fa787c86c2a4c12ef96aa3f530498a6d546aaa4df0a4a0a36e89b31b983dc

Download Submit
C:\Windows\RWI0E1C.exe

Filesize
320KB

MD5
fee07778a717de28afc3fcbb44e37ed5

SHA1
7765c1213b566bddef7e900143efb9bd94deb172

SHA256
2299b5f37d14fc8bc480d39ee2ddfd6dd5632be8c5fc8941b9e0878e4666c859

SHA512
1aba92723e04481c7b5055dcd67221447496f23ee97ff7b6d5c1119763f816c9b4494796fc1f3e27ae7d51711e1efbd7bf18602568ed71f5d6f093a4c853e970

Download Submit
C:\Windows\SysWOW64\EDH6M5W.exe

Filesize
320KB

MD5
b64e37e0603d3d092595d52e761bd381

SHA1
438d79070d9304b0423da5f30e50b64775506349

SHA256
d07b9997bfd6c9932d262a6e634618e871747bbbd8ef7ff43bd609938ac92da2

SHA512
4d2c8f0acd180eb8785691077c3a076c318ad5944b930d5fd44e1c6ef8fc1ff2c9b849d27b02e8d5bf8654334beff291b82b0d4f2c568a4e1c95f74ce076819e

Download Submit
C:\Windows\SysWOW64\NFG6K7T\VQO2V7Q.cmd

Filesize
320KB

MD5
c6b9fd89a561af318be668b937316b64

SHA1
2ed426b4f1a1db0619e5dfdc004af19b693dbda6

SHA256
f4b113cb6d34a26d72805dd7d782e555eab860bb74728af906ac43d7f5379226

SHA512
a940f038e48e80e29b1ba38d6755bb5c5e7f8f29b60b53b0a3c3154c63941290000ec4ac1bd60f1775720efcc43e23153d518107e6f9ade42bb269b0b3bb602b

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
f22908b15bb02468573a96548e208ee0

SHA1
7f3f98bf94173130e31b39c09b4df205b3c35f36

SHA256
6fc9a90b25851efb7c2b8fbd62d22d093c24fbb0b3a0f3e0ff393ac90cd45338

SHA512
0bffe28aca141822e656ebd8295be98f2fad4d0fb2678ad66f1fb2bb5d5a1cf28c1f69c04b619e1db5a92d4297dbadeaa5d196746b091159c7683270a415a096

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
d3749d6ad5827ff4671d95582f43e93a

SHA1
bda662852e8e5b25b2f41a1c10871230af8cc370

SHA256
f4ac2a6b1bc10a81fa28c17f94750ab53e25e5d7114571b907927a72b9fa73b7

SHA512
169b4cbcbf74e2c94aeb6d2532e8973d6ad509684482ea43d6652123e80d715be2a206c9647eafe431983b16cfbe3ef27f13a66b6dd9503336b8a6737a189089

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
2ec2659ec7f07edc03a3961477fec1ba

SHA1
5bddbaf25724142738f70896ddf079c5445d1aa1

SHA256
77e1e0a750cdaf9a6a54c8ab0857f2787e3a1280ac2762f320a5d6e98b340bb7

SHA512
243d5d33ccbd52f47406c4e687801263b971c4604469cdd94d5fce9a42054af6efc7463c6524c9aa3a25f37d291d1356a134f9e76fd099504c57e70e783b1d3f

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
e311ef4df4009a9926e9d774568ad810

SHA1
8b546b1b626a28a4b117359065e43d5217cb9cfe

SHA256
dba59c4d0417da694c70255a4741b94c92bd6206b932870b4d1b8eefe7fbd9b8

SHA512
597399a7c5cb4b34de5ce070ccd2c2684bb601dded6456eb0bbd7a0cd13d0d4cefbbdc3a9a445840f033a49ec2554c46764535e115897623476ab6be64a89452

Download Submit
C:\Windows\lsass.exe

Filesize
320KB

MD5
79f820c9d73df65c8a650c065776c454

SHA1
ab901eca04cfc107dec9ef228ac8e5cd504ce978

SHA256
32e084f3b7d0fa8ddcbb7c822ca88356fcc7936932489b0a6c256c08977ff937

SHA512
292e521ce2ad967a2d29aa4b46869830a2dd48831328971d517d6883136d2fab4ee0c67c5969b23336c8cb34610297451b6ea9ac88c5f3b57e9c7b5e59524128

Download Submit
C:\Windows\lsass.exe

Filesize
320KB

MD5
b7e4902555d671fd57c2c83deac8c0b6

SHA1
9052674d70809843ee2268e3611fac0ea87254b2

SHA256
937aeb735e392ee07d31839984ba4ea9a4a3b2736c0c9bd6eb7550a1321122d6

SHA512
322959e0ed003fa9c6a9ccc32b0bee1e6084b9d9de8efcb37336b8deccae3e4e63c98e7bc7a56f897a62c6a0bcd1a765c70cf52c5c67848526877401d46ef2a7

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
3b039cfcb4049f9ddb4d6a89825ba89b

SHA1
db124e3221b89df324b8cce304dbc50baa313145

SHA256
8081e0930368fdd7a905846cc989b12886187812fb20842ba13264b5a1cee097

SHA512
c2caaaa9d072f778abc1ebfea190082234b93e521912fd021e3bb3e8edb23fc7f9cb9e7a5ca5ef028659e1369484815122d11844946c3ef6658104349020eeb6

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
b2b272a9776b0930b87d0881c1ada58e

SHA1
86b65a3ea5f2d41ce63b550b9ba9e6fdfa9beaa6

SHA256
9cc8df5d085d4115090418d4e024e416545080611bd55d8d688a1e05293113e7

SHA512
88ccef1c4c3d673a608f62d7cb9e2da4aea4b85906ba2810f8a6a66f2a051b062267b2464acca136f507f5b54029b6c640b22a9bb970cd9f50d5691df7903700

Download Submit
memory/220-276-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/220-308-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3544-279-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3544-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5152-58-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5152-302-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5320-94-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5320-307-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5556-75-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5556-305-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5780-298-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/5780-306-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5780-91-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads