56fd07483550ff364725fa4d1d704e0d0d46e21a3ca8b3744d5ce0e2f5638e4e

General

Target

41521fd54fe2b33bb7e5fa73c170c660N.exe
Size

94KB
MD5

41521fd54fe2b33bb7e5fa73c170c660
SHA1

fccb2857d49437eec068f86c6ee60e260c3de2c6
SHA256

56fd07483550ff364725fa4d1d704e0d0d46e21a3ca8b3744d5ce0e2f5638e4e
SHA512

4f70e625008b04150655ffe35a77e16fc6da12547a298a86ecd6dcd990896071b319faa001acfb63fd19e367ccb378ce3f5027505d9923a46b93f7bb5f04c142
SSDEEP

1536:FQ2lT0Q4OgsMMraZ/cc55k/rUhzCpn2LoS5DUHRbPa9b6i+sImo71+jqx:FrOOUdZ1DkohzKMoS5DSCopsIm81+jqx

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	41521fd54fe2b33bb7e5fa73c170c660N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	41521fd54fe2b33bb7e5fa73c170c660N.exe

Executes dropped EXE 1 IoCs

pid	Process
4188	Niklpj32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Niklpj32.exe	41521fd54fe2b33bb7e5fa73c170c660N.exe
File opened for modification	C:\Windows\SysWOW64\Niklpj32.exe	41521fd54fe2b33bb7e5fa73c170c660N.exe
File created	C:\Windows\SysWOW64\Fcppfn32.dll	41521fd54fe2b33bb7e5fa73c170c660N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4580	4188	WerFault.exe	84
3668	4188	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41521fd54fe2b33bb7e5fa73c170c660N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niklpj32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	41521fd54fe2b33bb7e5fa73c170c660N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	41521fd54fe2b33bb7e5fa73c170c660N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	41521fd54fe2b33bb7e5fa73c170c660N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	41521fd54fe2b33bb7e5fa73c170c660N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcppfn32.dll"	41521fd54fe2b33bb7e5fa73c170c660N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	41521fd54fe2b33bb7e5fa73c170c660N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4188	4656	41521fd54fe2b33bb7e5fa73c170c660N.exe	84
PID 4656 wrote to memory of 4188	4656	41521fd54fe2b33bb7e5fa73c170c660N.exe	84
PID 4656 wrote to memory of 4188	4656	41521fd54fe2b33bb7e5fa73c170c660N.exe	84

C:\Users\Admin\AppData\Local\Temp\41521fd54fe2b33bb7e5fa73c170c660N.exe
"C:\Users\Admin\AppData\Local\Temp\41521fd54fe2b33bb7e5fa73c170c660N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\Niklpj32.exe
  C:\Windows\system32\Niklpj32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 392
    3⤵
    - Program crash
    PID:4580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 400
    3⤵
    - Program crash
    PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4188 -ip 4188
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4188 -ip 4188
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Niklpj32.exe

Filesize
94KB

MD5
36d825414b3801e54df3b184ca148144

SHA1
a9746c9c0cc2a6f8042c564e25b63fd1e4a5df03

SHA256
97b72b9c07c28a351f7869ca9be0cda5c38d4a84bb4c8f9853daea43ed00c9cf

SHA512
51f7c6a823e7776a816ba00a0cceb0b381c873b27d26efecdf87296e04dbda7b54dd72ba5532afdb94361ebdfa32c498d6a8eef9d5ba8086660e81d99dd0d929

Download Submit
memory/4188-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4188-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4656-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4656-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4656-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads