Overview
overview
7Static
static
3MasterModz...CK.dll
windows7-x64
1MasterModz...CK.dll
windows10-2004-x64
1MasterModz...dz.exe
windows7-x64
3MasterModz...dz.exe
windows10-2004-x64
7MasterModz...et.dll
windows7-x64
1MasterModz...et.dll
windows10-2004-x64
1MasterModz...n1.exe
windows7-x64
3MasterModz...n1.exe
windows10-2004-x64
7Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
MasterModz27/MSWINSCK.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MasterModz27/MSWINSCK.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
MasterModz27/MasterModz.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MasterModz27/MasterModz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
MasterModz27/packet.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
MasterModz27/packet.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
MasterModz27/vietclan1.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
MasterModz27/vietclan1.exe
Resource
win10v2004-20240508-en
General
-
Target
MasterModz27/MasterModz.exe
-
Size
52KB
-
MD5
1bfa8ab12fec611ddd872b3197b385f1
-
SHA1
a9f56ce338554ce73585903e74a9fdfd6f241913
-
SHA256
90f079ad009326b2ae731abf3a2dddd391becdd90525870d4e0b031e8fd311f9
-
SHA512
4cd9f8431a8d62520cd131b6846fd5a52a3d43c06a08faf4764af8e24a773aaa872e1f60a784efe2792766b9d7ba439acc45a1598b2a7c6ac16992428b12d564
-
SSDEEP
768:7ukbeckSSb7XyQE8uBRGBMnnTBbVcecD8FZ++jP2WdFy4Am:ikbPSb/ujG0YecD8b++zN61m
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RunDll32.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\INetHistory\desktop.ini rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-Revision = "0" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" RunDll32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" RunDll32.exe Key deleted \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs RunDll32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main RunDll32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VendorId = "4318" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomStorageState\EdpCleanupState = "0" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-SoftwareFallback = "0" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-SubSysId = "0" RunDll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" RunDll32.exe Key deleted \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage RunDll32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomStorageState RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Cleared = "1" RunDll32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch RunDll32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\BrowserEmulation RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-DeviceId = "140" RunDll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Cleared_TIMESTAMP = 8843dd4803ccda01 RunDll32.exe -
Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19 rundll32.exe Key created \REGISTRY\USER\S-1-5-19\Software rundll32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft rundll32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography rundll32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133643453434810622" RunDll32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry rundll32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C508CF69-C3F7-4058-9E02-59F2EA300564}\ProxyStubClsid32 MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C508CF69-C3F7-4058-9E02-59F2EA300564} MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6ECCF727-DDFA-478A-A330-569BEC61DBE1}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\MiscStatus\ = "0" MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\VERSION MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MasterModz27\\packet.ocx, 30000" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6ECCF727-DDFA-478A-A330-569BEC61DBE1}\ProxyStubClsid32 MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\TypeLib\ = "{A1D05426-608B-499B-A833-390B6F96627C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Project1.UserControl1\Clsid MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C508CF69-C3F7-4058-9E02-59F2EA300564}\ = "_UserControl1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6ECCF727-DDFA-478A-A330-569BEC61DBE1}\ = "__UserControl1" MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\Control MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\InprocServer32\ThreadingModel = "Apartment" MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Project1.UserControl1\Clsid\ = "{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\VERSION\ = "1.0" MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C508CF69-C3F7-4058-9E02-59F2EA300564}\ProxyStubClsid MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\ProgID\ = "Project1.UserControl1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6ECCF727-DDFA-478A-A330-569BEC61DBE1}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C508CF69-C3F7-4058-9E02-59F2EA300564}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C508CF69-C3F7-4058-9E02-59F2EA300564} MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C508CF69-C3F7-4058-9E02-59F2EA300564}\TypeLib MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\MiscStatus MasterModz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6ECCF727-DDFA-478A-A330-569BEC61DBE1}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C508CF69-C3F7-4058-9E02-59F2EA300564}\ = "_UserControl1" MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A1D05426-608B-499B-A833-390B6F96627C}\1.0\FLAGS MasterModz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} MasterModz.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23EB59B9-8849-48D7-AB4C-2A13FDCB674D}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Project1.UserControl1\ = "Project1.UserControl1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A1D05426-608B-499B-A833-390B6F96627C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MasterModz27\\packet.ocx" MasterModz.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3440 rundll32.exe Token: SeDebugPrivilege 3440 rundll32.exe Token: SeDebugPrivilege 3440 rundll32.exe Token: SeDebugPrivilege 3440 rundll32.exe Token: SeDebugPrivilege 3440 rundll32.exe Token: SeDebugPrivilege 3440 rundll32.exe Token: SeDebugPrivilege 3440 rundll32.exe Token: SeDebugPrivilege 3440 rundll32.exe Token: SeDebugPrivilege 3440 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4296 RunDll32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3152 MasterModz.exe 3152 MasterModz.exe 3152 MasterModz.exe 3152 MasterModz.exe 4332 vietclan1.dll 4332 vietclan1.dll 4332 vietclan1.dll -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3152 wrote to memory of 3388 3152 MasterModz.exe 81 PID 3152 wrote to memory of 3388 3152 MasterModz.exe 81 PID 3152 wrote to memory of 3388 3152 MasterModz.exe 81 PID 3152 wrote to memory of 1652 3152 MasterModz.exe 82 PID 3152 wrote to memory of 1652 3152 MasterModz.exe 82 PID 3152 wrote to memory of 1652 3152 MasterModz.exe 82 PID 3152 wrote to memory of 4332 3152 MasterModz.exe 83 PID 3152 wrote to memory of 4332 3152 MasterModz.exe 83 PID 3152 wrote to memory of 4332 3152 MasterModz.exe 83 PID 4332 wrote to memory of 4296 4332 vietclan1.dll 84 PID 4332 wrote to memory of 4296 4332 vietclan1.dll 84 PID 4332 wrote to memory of 4296 4332 vietclan1.dll 84 PID 4296 wrote to memory of 2020 4296 RunDll32.exe 88 PID 4296 wrote to memory of 2020 4296 RunDll32.exe 88 PID 4296 wrote to memory of 2020 4296 RunDll32.exe 88 PID 4296 wrote to memory of 3440 4296 RunDll32.exe 90 PID 4296 wrote to memory of 3440 4296 RunDll32.exe 90 PID 4296 wrote to memory of 3440 4296 RunDll32.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasterModz27\MasterModz.exe"C:\Users\Admin\AppData\Local\Temp\MasterModz27\MasterModz.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\MasterModz27\packet.ocx"2⤵
- Modifies registry class
PID:3388
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\MasterModz27\MSWINSCK.OCX"2⤵
- Modifies registry class
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\MasterModz27\vietclan1.dllC:\Users\Admin\AppData\Local\Temp\MasterModz27\vietclan1.dll2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 43513⤵
- Checks computer location settings
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -ResetDestinationList4⤵PID:2020
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:4351 WinX:0 WinY:0 IEFrame:000000004⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5dfeabde84792228093a5a270352395b6
SHA1e41258c9576721025926326f76063c2305586f76
SHA25677b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
SHA512e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd
-
Filesize
11KB
MD59234071287e637f85d721463c488704c
SHA1cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA25665cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
SHA51287d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
-
Filesize
1KB
MD57e81a79f38695e467a49ee41dd24146d
SHA1035e110c36bf3072525b05394f73d1ba54d0d316
SHA256a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536
SHA51253c5f2f2b9ad8b555f9ae6644941cf2016108e803ea6ab2c7418e31e66874dea5a2bc04be0fa9766e7206617879520e730e9e3e0de136bae886c2e786082d622
-
Filesize
4KB
MD5d65ec06f21c379c87040b83cc1abac6b
SHA1208d0a0bb775661758394be7e4afb18357e46c8b
SHA256a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
SHA5128a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
-
Filesize
130B
MD5941682911c20b2dabecb20476f91c98a
SHA10b0becf019cb15e75cdfa23bf0d4cb976f109baa
SHA2563fef99e07b0455f88a5bb59e83329d0bfcebe078d907985d0abf70be26b9b89a
SHA512a12f5caf5fd39cf2ae600e4378b9296d07787a83ae76bc410b89182a2f8e3202c4ca80d811d548193dff439541de9447f9fa141ebfd771e7ab7a6053cb4af2b3