4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729

Analysis

max time kernel
120s
max time network
69s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Size

3.0MB
MD5

078cb9b595c98ffc17e0a8410df44420
SHA1

dade71931dd3d282340a0b0302d85b0c3c2d5551
SHA256

4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729
SHA512

091a9c0a16678aa2f0a904edbfbd4de34a346cd04cedfa9615941f3b794942c73297b5be62764d5a39adfefc464cb26d3fddc822ab60a737d03e7e5b9be2998f
SSDEEP

3072:ThzV9Rd1gWIoKMHOlQtjZtIax1I5cJKAcBnyypQ1x2Cmswz:dRbOCtjvpJUfKxms

Score

10^/10

discovery evasion execution persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	DHCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ftdisk.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DISABLEREGISTRYTOOLS = "1"	DHCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DISABLEREGISTRYTOOLS = "1"	ftdisk.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\directx.exe	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1052	DHCP.exe
2764	ftdisk.exe

Loads dropped DLL 2 IoCs

pid	Process
2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	DHCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	DHCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	ftdisk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	ftdisk.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe

Drops autorun.inf file 1 TTPs 8 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\Autorun.inf	ftdisk.exe
File opened for modification	F:\Autorun.inf	ftdisk.exe
File created	C:\Autorun.inf	DHCP.exe
File opened for modification	C:\Autorun.inf	DHCP.exe
File created	F:\Autorun.inf	DHCP.exe
File opened for modification	F:\Autorun.inf	DHCP.exe
File created	C:\Autorun.inf	ftdisk.exe
File opened for modification	C:\Autorun.inf	ftdisk.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dhcp.sys	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\ftdisk.sys	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\dpvsrv.dll	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\igfx32.lrc	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\ftdisk.exe	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\helpsrv.exe	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\initgdi32.cui	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\compmhelp.htm	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\media\funnu.wav	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\help\ipshelp.hlp	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\DHCP.exe	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Launches sc.exe 52 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2084	SC.exe
2692	SC.exe
1772	SC.exe
2456	SC.exe
2768	SC.exe
2684	SC.exe
2060	SC.exe
376	SC.exe
776	SC.exe
2200	SC.exe
2912	SC.exe
1752	SC.exe
2600	SC.exe
924	SC.exe
2776	SC.exe
1972	SC.exe
2808	SC.exe
544	SC.exe
1620	SC.exe
2928	SC.exe
936	SC.exe
2668	SC.exe
1560	SC.exe
1800	SC.exe
2736	SC.exe
704	SC.exe
2140	SC.exe
1456	SC.exe
2656	SC.exe
2996	SC.exe
772	SC.exe
2788	SC.exe
2316	SC.exe
2676	SC.exe
900	SC.exe
2784	SC.exe
3068	SC.exe
2644	SC.exe
2688	SC.exe
1092	SC.exe
1800	SC.exe
2660	SC.exe
2084	SC.exe
2076	SC.exe
2208	SC.exe
2712	SC.exe
2216	SC.exe
2900	SC.exe
2920	SC.exe
1656	SC.exe
1820	SC.exe
2004	SC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskpart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DHCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskpart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ftdisk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1229272821-838170752-839522115-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN	DHCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1229272821-838170752-839522115-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN	ftdisk.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000100054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 0001310000000000000000001600346631363563383530343639336336623835343632386131636365363936326332666434313962313833313161326161356531363962353038666338303732394e00b00008000400efbe00000000000000002a0000000000000000000000000000000000000000000000000034006600310036003500630038003500300034003600390033006300360062003800350034003600320038006100310063006300650036003900360032006300320066006400340031003900620031003800330031003100610032006100610035006500310036003900620035003000380066006300380030003700320039004e00000050000000	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
1052	DHCP.exe
1052	DHCP.exe
2764	ftdisk.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe
2764	ftdisk.exe
1052	DHCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
1052	DHCP.exe
2764	ftdisk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1800	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	98
PID 2340 wrote to memory of 1800	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	98
PID 2340 wrote to memory of 1800	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	98
PID 2340 wrote to memory of 1800	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	98
PID 2340 wrote to memory of 2004	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	32
PID 2340 wrote to memory of 2004	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	32
PID 2340 wrote to memory of 2004	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	32
PID 2340 wrote to memory of 2004	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	32
PID 2340 wrote to memory of 2200	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	34
PID 2340 wrote to memory of 2200	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	34
PID 2340 wrote to memory of 2200	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	34
PID 2340 wrote to memory of 2200	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	34
PID 2340 wrote to memory of 2076	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	35
PID 2340 wrote to memory of 2076	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	35
PID 2340 wrote to memory of 2076	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	35
PID 2340 wrote to memory of 2076	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	35
PID 2340 wrote to memory of 2084	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	36
PID 2340 wrote to memory of 2084	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	36
PID 2340 wrote to memory of 2084	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	36
PID 2340 wrote to memory of 2084	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	36
PID 2340 wrote to memory of 3068	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	111
PID 2340 wrote to memory of 3068	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	111
PID 2340 wrote to memory of 3068	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	111
PID 2340 wrote to memory of 3068	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	111
PID 2340 wrote to memory of 2900	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	38
PID 2340 wrote to memory of 2900	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	38
PID 2340 wrote to memory of 2900	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	38
PID 2340 wrote to memory of 2900	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	38
PID 2340 wrote to memory of 2208	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	118
PID 2340 wrote to memory of 2208	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	118
PID 2340 wrote to memory of 2208	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	118
PID 2340 wrote to memory of 2208	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	118
PID 2340 wrote to memory of 2140	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	40
PID 2340 wrote to memory of 2140	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	40
PID 2340 wrote to memory of 2140	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	40
PID 2340 wrote to memory of 2140	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	40
PID 2340 wrote to memory of 2644	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	116
PID 2340 wrote to memory of 2644	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	116
PID 2340 wrote to memory of 2644	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	116
PID 2340 wrote to memory of 2644	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	116
PID 2340 wrote to memory of 2684	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	126
PID 2340 wrote to memory of 2684	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	126
PID 2340 wrote to memory of 2684	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	126
PID 2340 wrote to memory of 2684	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	126
PID 2340 wrote to memory of 2788	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	128
PID 2340 wrote to memory of 2788	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	128
PID 2340 wrote to memory of 2788	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	128
PID 2340 wrote to memory of 2788	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	128
PID 2340 wrote to memory of 2920	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	49
PID 2340 wrote to memory of 2920	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	49
PID 2340 wrote to memory of 2920	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	49
PID 2340 wrote to memory of 2920	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	49
PID 2340 wrote to memory of 2692	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	50
PID 2340 wrote to memory of 2692	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	50
PID 2340 wrote to memory of 2692	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	50
PID 2340 wrote to memory of 2692	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	50
PID 2340 wrote to memory of 2668	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	51
PID 2340 wrote to memory of 2668	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	51
PID 2340 wrote to memory of 2668	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	51
PID 2340 wrote to memory of 2668	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	51
PID 2340 wrote to memory of 2912	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	53
PID 2340 wrote to memory of 2912	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	53
PID 2340 wrote to memory of 2912	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	53
PID 2340 wrote to memory of 2912	2340	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	53

System policy modification 1 TTPs 8 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	ftdisk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NOFIND = "1"	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NORUN = "1"	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	DHCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NOFIND = "1"	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NORUN = "1"	ftdisk.exe

C:\Users\Admin\AppData\Local\Temp\4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
"C:\Users\Admin\AppData\Local\Temp\4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\SC.exe
  SC STOP AudioSrv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1800
- C:\Windows\SysWOW64\SC.exe
  SC DELETE AudioSrv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2004
- C:\Windows\SysWOW64\SC.exe
  SC STOP spooler
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2200
- C:\Windows\SysWOW64\SC.exe
  SC DELETE spooler
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2076
- C:\Windows\SysWOW64\SC.exe
  SC STOP SENS
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2084
- C:\Windows\SysWOW64\SC.exe
  SC DELETE SENS
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3068
- C:\Windows\SysWOW64\SC.exe
  SC STOP wscsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2900
- C:\Windows\SysWOW64\SC.exe
  SC DELETE wscsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2208
- C:\Windows\SysWOW64\SC.exe
  SC STOP SharedAccess
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2140
- C:\Windows\SysWOW64\SC.exe
  SC DELETE SharedAccess
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Windows\SysWOW64\SC.exe
  SC STOP srservice
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\SysWOW64\SC.exe
  SC DELETE srservice
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Windows\SysWOW64\SC.exe
  SC STOP wuauserv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2920
- C:\Windows\SysWOW64\SC.exe
  SC DELETE wuauserv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Windows\SysWOW64\SC.exe
  SC STOP avp
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2668
- C:\Windows\SysWOW64\SC.exe
  SC DELETE avp
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2912
- C:\Windows\DHCP.exe
  C:\Windows\DHCP.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1052
- - C:\Windows\SysWOW64\SC.exe
    SC STOP AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1620
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2060
- - C:\Windows\SysWOW64\SC.exe
    SC STOP spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1656
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:376
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1972
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:900
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1560
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2712
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2808
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:776
- - C:\Windows\SysWOW64\SC.exe
    SC STOP srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1772
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1820
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1456
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Windows\SysWOW64\SC.exe
    SC STOP avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2456
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1752
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2084
- - C:\Windows\SysWOW64\SC.exe
    SC STOP Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:1608
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:3036
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:2620
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1512
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:1576
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2784
- C:\Windows\SysWOW64\ftdisk.exe
  C:\Windows\system32\ftdisk.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2764
- - C:\Windows\SysWOW64\SC.exe
    SC STOP AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1800
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2216
- - C:\Windows\SysWOW64\SC.exe
    SC STOP spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2996
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:936
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2928
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:924
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2656
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2600
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2676
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2776
- - C:\Windows\SysWOW64\SC.exe
    SC STOP srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2768
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1092
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:704
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\SC.exe
    SC STOP avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2736
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2712
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:2012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-951410147-1766982951-1788032298-2003665811-1104977369-575817385-33464632-1032814819"
1⤵
PID:3068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "656296857-1343286849-1981315756443197647-102400128-12890814292058194321705584351"
1⤵
PID:2644

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1170993610-114906955-329709592-1195386307-666574427-1689447021-1052885845241904040"
1⤵
PID:2208

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "130797236463254610980171822412072229001160078937-961388195-534022703-819955201"
1⤵
PID:2684

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "324971043-1195065117-3965276552122632196-1287656042-945640816121474176595542892"
1⤵
PID:2788

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_dhS.bat

Filesize
30B

MD5
e364adc1af8dcd8855917c5f5e5aa32b

SHA1
95946e4905d32aba06e5e8f8df345ac2e80e688c

SHA256
0712c019ea16c5cd38cd6d71e7087abace758c7abbc63c5e4410fb9f6cb40b5f

SHA512
0faa612365b28429080983c1835595f74d5b1d94cae04418adcc1896871e84a1333f1f8f2715ae2c6951ee3cc452fb47f9bad1e31faa61b04f8fe8222f924d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dsP.bat

Filesize
154B

MD5
a9175117fbe053af5801fab1fc1d10c2

SHA1
a73480add868d1b38301c6a9357305f5e26a3937

SHA256
b0aed7ed335174276eff28862bc12a7ec2068c7f120d05ed0c1c97ef769c7d16

SHA512
9ca0c82fcfe6179a3fb3031d2f8418ecf5155a876a0f667573a4249e51f72d1a673e182c0b7adc5efad12b246f324212a6e5a9bf1b239b46129dc9fffe8736c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dyR.txt

Filesize
3B

MD5
3841822014f738222634f8040e3e5fef

SHA1
035aad85eef262df6c47a767762832f093d7411a

SHA256
b259bcb434250e59221023c52831a95998cc89345587a711578627e51ade37ec

SHA512
371b4cb8353a240dd6897b1af0a79d9e96c6e7e481a83f82dd21b175b292824df43f3e41d0c9b28409c2ae8cb2bcfe01619e2dbd560a001795433178b9dc21d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hcdRS.txt

Filesize
56B

MD5
274a7ef1109cd1b66e34dee14669cbdb

SHA1
dc318e1568d7e5b9440556ec94d42b1f3c1bbafa

SHA256
1343f7baec62086f30e2135dde0a8c152903e0531dd6747ee9b63ec04effff32

SHA512
cbd0b86c452edbf4c1c2d78b724ee913c2f67d53458148f1bc2355d1ee420f1d5719cc0560a677c2189be0f6663cc94e430efce961297e54c251234b0a04ccdf

Download Submit
C:\Windows\DHCP.exe

Filesize
3.2MB

MD5
b586147083e1a88e1b229df4b6c702e4

SHA1
a071422c50570f42c38765b4cee9ca9f27c50311

SHA256
e154ebf012f3cf07db18c18c1515ecc6b534b2d530a73a7d5b5ed871822e2efb

SHA512
ba360ca60ab9da53765a11aa2221940c2f639f57c56250468210d3c6064a857c685c3933aebfe3876ca87f200456aed8570582719ccfed30d6ca1ec4a5b94ed2

Download Submit
C:\Windows\Media\funnu.wav

Filesize
3.0MB

MD5
8c7bff000df48fd2f5914dec726fbc96

SHA1
1a8c6a30efbb310bcc35f7c7893ed83ae6b95089

SHA256
537b94483bd36c1ed4c0bff14ed215ec0ebd7966aba4a9d49e675473b35f5322

SHA512
f997e99a288400bc65177cc0f6e3ed4243d34406d88f3bf1b43da96d554d7a08da823d71dffcf2b36aa616f7b37758290bf31119424d3c27d2160d39fb705561

Download Submit
C:\Windows\SysWOW64\initgdi32.cui

Filesize
3.0MB

MD5
078cb9b595c98ffc17e0a8410df44420

SHA1
dade71931dd3d282340a0b0302d85b0c3c2d5551

SHA256
4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729

SHA512
091a9c0a16678aa2f0a904edbfbd4de34a346cd04cedfa9615941f3b794942c73297b5be62764d5a39adfefc464cb26d3fddc822ab60a737d03e7e5b9be2998f

Download Submit
C:\Windows\Temp\Drctx.bsti

Filesize
1KB

MD5
790c3f0c0ec3525d69efd88e9355de96

SHA1
a605cd2bd84d2d4096cd8f85d3baae9d120f1c70

SHA256
611ab7718034cdeca3b1540ea5b5b3d509750ac2e7d9b423b7f3cc20e52ca376

SHA512
4f383c4820602e61c27390ccc75ee7e76995dc7fdcf6c5e3313f7f754436505919d81b6a83f86478ed3490e66bc6b7e06a1b7e45d5fedccbdc18dc4b96472cb5

Download Submit
C:\Windows\Temp\Iter.inx

Filesize
14KB

MD5
a3b40ae1ea1007b944035a89e96eb21b

SHA1
323f6de8b18484ae979f479653132edbb8677142

SHA256
485c1d5ed308e41fa543d97855766f145867eb91882b172db3eb9ea6280d0ba4

SHA512
d9e26174c3e69fe40b53e8c91554e49b61705352357ecd0afc5a10b548623ec4c3d65799238a99e65c93e1b2e49416510e75470d0f10fddebd411c15002a09c6

Download Submit
C:\Windows\Temp\chk.chm

Filesize
14KB

MD5
144b85f03abbfab788298dfb9fa4b7a8

SHA1
97d2a008c95ca8b094e91b74d99f5959fe3fe7e4

SHA256
02241e88aa5dd0b99d4e9130f4d0557caf5c61eec5d6fc150fe54a5fe1542a0e

SHA512
25e0aedffc33a82807c63ad9694ac5f0605edf769a73986eb5121334db75a700781c0d202575f8b38d34fa20e53b7f1ca931e319179014482e7f336c63a97fef

Download Submit
C:\Windows\Temp\dos.cli

Filesize
1KB

MD5
11ec3af30ebabf1d7e9c36304bf4f57b

SHA1
c5aa8682392037064f8a0b852b84bf78455f5bb8

SHA256
a1d354df63b96640b5e61f9d5ce1d1cb9db501899683fb856d5bffa02a7ceece

SHA512
9223bfc220f0475ee81c220f8286776b2e6a93ac98d4fdc1e24c14de0084224da24c8b2f61bcd0ec6c4357d89ea6fc515fdc3ce78e0778c1bea0a4e3afc5b306

Download Submit
C:\Windows\Temp\ent.bnt

Filesize
1KB

MD5
97e8a304d95bb98ea34d1f54039cebe5

SHA1
26b51816c8145b5fd4a499c90b9c2fe38590a86a

SHA256
b26468b5b105833c8c557441e84892c8e620563ac0fb226a45580fdaa1bd7f4b

SHA512
8bdbdb526cc5933059512bc2f3889be2c2911e4736d0fa9110eb83b648fcff25906ab6993261dd6600888f4ae72e16036ea9f0866b742501b0668c53d8fe0156

Download Submit
C:\Windows\Temp\fldR.lnk

Filesize
17KB

MD5
f4fac00cb7f1638353ae9c0957fd4e69

SHA1
62f5b31658f60fdddc1fe8b2e5e99ebddac7083e

SHA256
67fde9c9f53ac9f14ca76c9bb912ae006083a19465fbf73a45e1e411c1c9e1bb

SHA512
41a031241d05e9f58e24055a71e67a23e03257c1c8c37b4190b92dc3d4a8c0e8d14f87a4d52a548915dc3c152fdf7098306391cc21fd20f045513be0b30de39d

Download Submit
C:\Windows\Temp\msi.cmu

Filesize
14KB

MD5
4659511a62321b0ed69c38a5dfe8fb95

SHA1
d74f52bd08d95776c84777892d1d099dd2836918

SHA256
a7b694859598040c5f854d40600eb02c343279bbc098b559ad6e9ed935082e1e

SHA512
bee9e33a2dbd5a9d254f5d776f81617dd80e06bb10cc26ad9b9535600c1beb490e7806462ac9bafef3af179c4936f51f5f9b4a91bea3c88d31b1f47e457f11fa

Download Submit
F:\Autorun.inf

Filesize
145B

MD5
384005d30a82e12a6223861eeb85ac7e

SHA1
2c1aa5dc2744617e8d42e2c3270596fa92cc17c6

SHA256
77a9539c1ede9ec5e331076ca2fe1103c4318b96a5d72904621b3b47159822d7

SHA512
7ff368c01638e9701138f20b108e02b8d1e9e4d7b40443fa00429b8bf6bd0dfcae8e364281756aa95f95982ff79c843a9b466929ed18d1cca00f418dfb2ef019

Download Submit
\Windows\SysWOW64\ftdisk.exe

Filesize
3.1MB

MD5
d25a7b4b487062fef28d8d9f8ec2b762

SHA1
f75e9ddf8fee97d6b0a5fc757b7ca49cd574ca0e

SHA256
26fdbfe17e705c737d35e1c724b81f7b56dffd3648459394e8f83595e22324c8

SHA512
c8d4001fac978585a3a4c7dcf5f62416a8b84b2b8e2038dbbd609fc57e7380f93739f2cea0bb3bf854d736e09757004d76864422d21938b52507bc84459a5b54

Download Submit