aa351b407ba41b41c45ffd745ef0a1d9a106c68b2ce4593fd8739448ce28f642

Resubmissions

14/10/2024, 22:44

241014-2n92lsthmk 7

14/10/2024, 22:43

241014-2naxhstgrm 7

Analysis

max time kernel
44s
max time network
39s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ATCSMon410.exe
Size

3.3MB
MD5

c456f4b0342847576440ae92c7a66bc5
SHA1

19f80e0e46229a8dd97afa8974bac62e9d1a9d6b
SHA256

aa351b407ba41b41c45ffd745ef0a1d9a106c68b2ce4593fd8739448ce28f642
SHA512

46fe172be682831f70898103b1628e865b586190de1aa0ba1553c19beaaf535430c96226f893a2b352fa4234a767a8f59402b29b00d4884e8ebabcf61dfe6a6d
SSDEEP

98304:XnUMExhmHmE5A5RaND7ILtEe27+sPuzP6UddcCm46Jyvq:Xn1ExxE5Fhy6NuzPz/cK6Jyvq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3000	ATCSMon410.tmp
604	ATCSMon.exe

Loads dropped DLL 20 IoCs

pid	Process
1040	ATCSMon410.exe
3000	ATCSMon410.tmp
3000	ATCSMon410.tmp
3000	ATCSMon410.tmp
3000	ATCSMon410.tmp
3000	ATCSMon410.tmp
3000	ATCSMon410.tmp
3000	ATCSMon410.tmp
2112	regsvr32.exe
2956	regsvr32.exe
1892	regsvr32.exe
1424	regsvr32.exe
1200	regsvr32.exe
2128	regsvr32.exe
2284	regsvr32.exe
3000	ATCSMon410.tmp
604	ATCSMon.exe
604	ATCSMon.exe
604	ATCSMon.exe
604	ATCSMon.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\is-3SASD.tmp	ATCSMon410.tmp
File created	C:\Windows\SysWOW64\is-I0RA8.tmp	ATCSMon410.tmp
File created	C:\Windows\SysWOW64\is-P8D8K.tmp	ATCSMon410.tmp
File created	C:\Windows\SysWOW64\is-D4DUS.tmp	ATCSMon410.tmp
File created	C:\Windows\SysWOW64\is-85S59.tmp	ATCSMon410.tmp
File created	C:\Windows\SysWOW64\is-6524T.tmp	ATCSMon410.tmp

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\ATCS Monitor\is-MC2DS.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-848M2.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-OEO3G.tmp	ATCSMon410.tmp
File opened for modification	C:\Program Files\ATCS Monitor\ATCSMon.url	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-RSD2S.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-OQF48.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-44BT8.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-UG25D.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-B2OR4.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-S1NCR.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-A91IK.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-RN0PK.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\unins000.dat	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-06EL3.tmp	ATCSMon410.tmp
File opened for modification	C:\Program Files\ATCS Monitor\atcsdb.ldb	ATCSMon.exe
File opened for modification	C:\Program Files\ATCS Monitor\unins000.dat	ATCSMon410.tmp
File opened for modification	C:\Program Files\ATCS Monitor\atcsdb.mdb	ATCSMon.exe
File created	C:\Program Files\ATCS Monitor\Layouts\is-M3G68.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\Mcps\is-2I6LL.tmp	ATCSMon410.tmp
File opened for modification	C:\Program Files\ATCS Monitor\system.mdb	ATCSMon.exe
File created	C:\Program Files\ATCS Monitor\is-TUIK6.tmp	ATCSMon410.tmp
File created	C:\Program Files\ATCS Monitor\is-KR1DU.tmp	ATCSMon410.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATCSMon410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATCSMon410.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATCSMon.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000917aa0ee67c42e5e547aa97629bea3fcd803f0899a711da04b4b52585d5cf859000000000e80000000020000200000006556e164c1b2d5d509dae9a4cd4784b970f3eecaf5f8f3b483544c7aebd496142000000088dffc323dcb289e7d88af1ebb929e95792deaa3984f4d3524dc43236db29f3740000000dc865d8df86b63a9c257c7a699fde19cfba4eb8c41309604483645a4b4b2063c5f57a6947d6a20d9613cecd438066c31874616d0baf880611397c544bca4cd0c	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c094fe998a1edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\AlternateCLSID = "{F91CAF91-225B-43A7-BB9E-472F991FC402}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\AlternateCLSID = "{0B314611-2C19-4AB4-8513-A6EEA569D3C4}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{A0E7BF67-8D30-4620-8825-7111714C7CAB}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB43B561-8A7D-11EF-98A3-428A07572FD0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\AlternateCLSID = "{996BF5E0-8044-4650-ADEB-0B013914E99C}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\AlternateCLSID = "{24B224E0-9545-4A2F-ABD5-86AA8A849385}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\AlternateCLSID = "{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000006c67eddd0819afaa6bcf0c1837b9f0b99daf7d5048759a67974489805f3d910b000000000e80000000020000200000002ec292288c04ac99eed0cabf87761cf7ba3bf47ee4cb7c6251c20bef6069a68590000000cc32ad96016d57562c4626690275be559060f852237e820f873ebb5f5f91616cf56a03b12a5ebafabd09889fc6fe2d55d2d3d09afddccb2ed460ddec10537bdc35c2e2041eaf35128f18e9696c60f68a3baa9c65765d24022054e01a91d75273892626d3256c7cd96e34048a3ff1a9bfd0100206f2d7e30a3a6ca4ac5c66dd1167b7d726c562ed0b0aa16f1ae776019340000000d1e50aacb4672a8263ca245a0ca50ea3ebd3ffc6539105370d32f3c82fce1db8ba397cd4a7723c42159cc9a52673099d95700405a33ae405efe7aa48cc9dad0e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\AlternateCLSID = "{7DC6F291-BF55-4E50-B619-EF672D9DCC58}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\AlternateCLSID = "{627C8B79-918A-4C5C-9E19-20F66BF30B86}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C70-067D-11D0-95D8-00A02463AB28}\ = "IScriptModule"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\Version\ = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl.2\CLSID\ = "{DD9DA666-8594-11D1-B16A-00C0F0283628}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\ = "Microsoft Toolbar Control 6.0 (SP6)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B16553C0-06DB-101B-85B2-0000C009BE81}\ = "SpinButton"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0E7BF67-8D30-4620-8825-7111714C7CAB}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA660-8594-11D1-B16A-00C0F0283628}\ = "IComboItem"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\InprocServer32\ = "C:\\Windows\\SysWow64\\mscomctl.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl.2\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl.2\CLSID\ = "{35053A22-8589-11D1-B16A-00C0F0283628}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E5A540-1850-11CF-9D53-00AA003C9CB6}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6597-857C-11D1-B16A-00C0F0283628}\ = "ITabs"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ = "DMSCommEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\VersionIndependentProgID\ = "MSComctlLib.ProgCtrl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "237969"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl.2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B314611-2C19-4AB4-8513-A6EEA569D3C4}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\InprocServer32\ = "C:\\Windows\\SysWow64\\mscomctl.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32\ = "C:\\Windows\\SysWow64\\comdlg32.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\TypeLib\ = "{3B7C8863-D78F-101B-B9B5-04021C009402}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3000	ATCSMon410.tmp
2812	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
604	ATCSMon.exe
2812	iexplore.exe
2812	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
604	ATCSMon.exe
604	ATCSMon.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 3000	1040	ATCSMon410.exe	29
PID 1040 wrote to memory of 3000	1040	ATCSMon410.exe	29
PID 1040 wrote to memory of 3000	1040	ATCSMon410.exe	29
PID 1040 wrote to memory of 3000	1040	ATCSMon410.exe	29
PID 1040 wrote to memory of 3000	1040	ATCSMon410.exe	29
PID 1040 wrote to memory of 3000	1040	ATCSMon410.exe	29
PID 1040 wrote to memory of 3000	1040	ATCSMon410.exe	29
PID 3000 wrote to memory of 2112	3000	ATCSMon410.tmp	30
PID 3000 wrote to memory of 2112	3000	ATCSMon410.tmp	30
PID 3000 wrote to memory of 2112	3000	ATCSMon410.tmp	30
PID 3000 wrote to memory of 2112	3000	ATCSMon410.tmp	30
PID 3000 wrote to memory of 2112	3000	ATCSMon410.tmp	30
PID 3000 wrote to memory of 2112	3000	ATCSMon410.tmp	30
PID 3000 wrote to memory of 2112	3000	ATCSMon410.tmp	30
PID 3000 wrote to memory of 2956	3000	ATCSMon410.tmp	31
PID 3000 wrote to memory of 2956	3000	ATCSMon410.tmp	31
PID 3000 wrote to memory of 2956	3000	ATCSMon410.tmp	31
PID 3000 wrote to memory of 2956	3000	ATCSMon410.tmp	31
PID 3000 wrote to memory of 2956	3000	ATCSMon410.tmp	31
PID 3000 wrote to memory of 2956	3000	ATCSMon410.tmp	31
PID 3000 wrote to memory of 2956	3000	ATCSMon410.tmp	31
PID 3000 wrote to memory of 1228	3000	ATCSMon410.tmp	32
PID 3000 wrote to memory of 1228	3000	ATCSMon410.tmp	32
PID 3000 wrote to memory of 1228	3000	ATCSMon410.tmp	32
PID 3000 wrote to memory of 1228	3000	ATCSMon410.tmp	32
PID 3000 wrote to memory of 1228	3000	ATCSMon410.tmp	32
PID 3000 wrote to memory of 1228	3000	ATCSMon410.tmp	32
PID 3000 wrote to memory of 1228	3000	ATCSMon410.tmp	32
PID 3000 wrote to memory of 1892	3000	ATCSMon410.tmp	33
PID 3000 wrote to memory of 1892	3000	ATCSMon410.tmp	33
PID 3000 wrote to memory of 1892	3000	ATCSMon410.tmp	33
PID 3000 wrote to memory of 1892	3000	ATCSMon410.tmp	33
PID 3000 wrote to memory of 1892	3000	ATCSMon410.tmp	33
PID 3000 wrote to memory of 1892	3000	ATCSMon410.tmp	33
PID 3000 wrote to memory of 1892	3000	ATCSMon410.tmp	33
PID 3000 wrote to memory of 1424	3000	ATCSMon410.tmp	34
PID 3000 wrote to memory of 1424	3000	ATCSMon410.tmp	34
PID 3000 wrote to memory of 1424	3000	ATCSMon410.tmp	34
PID 3000 wrote to memory of 1424	3000	ATCSMon410.tmp	34
PID 3000 wrote to memory of 1424	3000	ATCSMon410.tmp	34
PID 3000 wrote to memory of 1424	3000	ATCSMon410.tmp	34
PID 3000 wrote to memory of 1424	3000	ATCSMon410.tmp	34
PID 3000 wrote to memory of 1200	3000	ATCSMon410.tmp	35
PID 3000 wrote to memory of 1200	3000	ATCSMon410.tmp	35
PID 3000 wrote to memory of 1200	3000	ATCSMon410.tmp	35
PID 3000 wrote to memory of 1200	3000	ATCSMon410.tmp	35
PID 3000 wrote to memory of 1200	3000	ATCSMon410.tmp	35
PID 3000 wrote to memory of 1200	3000	ATCSMon410.tmp	35
PID 3000 wrote to memory of 1200	3000	ATCSMon410.tmp	35
PID 3000 wrote to memory of 2128	3000	ATCSMon410.tmp	36
PID 3000 wrote to memory of 2128	3000	ATCSMon410.tmp	36
PID 3000 wrote to memory of 2128	3000	ATCSMon410.tmp	36
PID 3000 wrote to memory of 2128	3000	ATCSMon410.tmp	36
PID 3000 wrote to memory of 2128	3000	ATCSMon410.tmp	36
PID 3000 wrote to memory of 2128	3000	ATCSMon410.tmp	36
PID 3000 wrote to memory of 2128	3000	ATCSMon410.tmp	36
PID 3000 wrote to memory of 2284	3000	ATCSMon410.tmp	37
PID 3000 wrote to memory of 2284	3000	ATCSMon410.tmp	37
PID 3000 wrote to memory of 2284	3000	ATCSMon410.tmp	37
PID 3000 wrote to memory of 2284	3000	ATCSMon410.tmp	37
PID 3000 wrote to memory of 2284	3000	ATCSMon410.tmp	37
PID 3000 wrote to memory of 2284	3000	ATCSMon410.tmp	37
PID 3000 wrote to memory of 2284	3000	ATCSMon410.tmp	37
PID 3000 wrote to memory of 1420	3000	ATCSMon410.tmp	38

C:\Users\Admin\AppData\Local\Temp\ATCSMon410.exe
"C:\Users\Admin\AppData\Local\Temp\ATCSMon410.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\is-AS5C1.tmp\ATCSMon410.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AS5C1.tmp\ATCSMon410.tmp" /SL5="$40114,3173702,54272,C:\Users\Admin\AppData\Local\Temp\ATCSMon410.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ATCS Monitor\subclass.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2112
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\msstdfmt.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2956
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\mscomctl.ocx"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1228
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\comdlg32.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1892
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\mswinsck.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1424
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\mscomm32.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1200
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\spin32.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2128
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\richtx32.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2284
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\msscript.ocx"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1420
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\ATCS Monitor\ReleaseNotes.htm
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2380
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:209930 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3060
- - C:\Program Files\ATCS Monitor\ATCSMon.exe
    "C:\Program Files\ATCS Monitor\ATCSMon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\ATCS Monitor\ATCSMon.ini

Filesize
32KB

MD5
7e1f49c1e2a1f2ae0c69811ceace74ae

SHA1
951535e9bac1287ff3b7b644be3a24e6f5b1ab7f

SHA256
06cb3d034289a1c17a234883e05841424bc3b07f81c8f79b095c82e39933e8ce

SHA512
2f1a36634da584d98ef68b6703f4f074f27c58129701561cf1f0b5a8443ecfabf2004ff8bc6f4d1ae0c3c8bd809078bed24a935f7cfc5f6198e3ba5ee3f2eb82

Download Submit
C:\Program Files\ATCS Monitor\LED_Green.gif

Filesize
98B

MD5
3a98380abd417ef0e4d6ec16d3e03a47

SHA1
7b0e1ccc44f9be8cf8dc4e71161fea7550f107ec

SHA256
c31bad179cf3d68d4b360003a58ce65eff7021042159055c42c08808c71f703c

SHA512
b92eedcda4c58c1a1683a832bf8223695d2450790967cb22c8cb8d6a74419e4a088013ce6a6a67efe05b9390472cba7b085348c6e59d7bba12f296cbd0cecdf6

Download Submit
C:\Program Files\ATCS Monitor\ReleaseNotes.htm

Filesize
6KB

MD5
d2c35ed1e65b84de67de20c794d58c3c

SHA1
f4c016077403f6f75f96ecc60f5237fe4f14b5ae

SHA256
f7fbaf470b6967f931700822acb669302c8b5dec3fd24b9aa2264d18292901df

SHA512
2f98c4ba23aeead01fa2c8c23f7d33b692beb9022063a8ca02ba91e0d5b4ca56db13fec7c4011b4e9ec277ebf5a6e0a2336584bceb32975cef270a53d18fb942

Download Submit
C:\Program Files\ATCS Monitor\atcsdb.mdb

Filesize
908KB

MD5
cb87b17054bb8020c610329235f17fc8

SHA1
28e302c750b09968ed0b01ca8e1a7e9344452409

SHA256
236faf090d12a97374f94a1d5ac898ebef89ac549f47f2e3363365e10d203f3a

SHA512
bf5c4abde5bba62d60bd966769888b6a0d5c412c5c0fa62bf7c1c3b5a07c79f337511ba2b9cd93293ce5f7ab8e52338deda368c49239ae1c302f826f3e540ddd

Download Submit
C:\Program Files\ATCS Monitor\layouts\metrolink orange-olive sub 1.14.lay

Filesize
225KB

MD5
f5665b3e51166634c4e7bc3cf08b7f7d

SHA1
b5a3059713953602313fe6cec5fd6ae7b619b8b8

SHA256
c2b73da0bac70a13ccffdbdfc00fca4b1ddbb182b95d7f86a9034b1b18eeddb1

SHA512
3ff307f006df5fe383b3b02c74ce9e87ed9431cb788feae1ea1a1fda55ce1956d58a635494eefc2098a1c6cb1a3474489c2816e2b68bf54b0e828bf6b6b3f4d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8efc88eea82d090f177a900eff201b09

SHA1
ef07b271631d260da0cc28380424bd89ef43e6df

SHA256
1bce7f6093d659665381212feb42f9dbb0c8fdd12ff37b3ef3c178c13649df54

SHA512
51b13429d4a87c8047db766f81b7c18cea0b9a56f5c64a50b8fc8dcd54cdfc5e7beb9ce654600e461978de28e80339408e7d11398819200c25a7b07f63ca903e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9287bab41db45f7521081e529f4319c

SHA1
247b88d96c0cf5ae96ec382df7699895555fe032

SHA256
1532890a6b9dc622e33fd8a4d504bf724aa8349b85535f276699c5c944bd28e7

SHA512
0d4e24e6761d68157a1b22900f96ead7ea57c590a905524749840c9f375a0d106be926b2210d8a320825048bdabb0b444e4a959634a14105d7a9726a34366a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78ada16783ea576b96186bccc20bef11

SHA1
74c6f0db37a55ef717ced414a5ef592366d06532

SHA256
b00ca80e84192197bfa7e71b6880ae489e44bd2c2e2562e33edb90e3e6b6f49e

SHA512
267be322d5bc5aa38bb706cc8026c0ee852698e48d3b614af08c37c78d343b333efbae5fccc76ba5d96b7783896b9ba85e10683e350b1112dbd78d7073e5b86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
008ded2a8787af91b0d9e548600add38

SHA1
d536aa845c0d51426ee1dcb533cd39046d5be642

SHA256
0f60b15d4b33a177bda6a48cbf8dc3ee79eb336c7c9fbe2438182f1a57fc1c3e

SHA512
2a2fbdb3ecd870e714d75faa9c890541140c3a1b0c445ff2cf085a622931b18c4a43559f4a4d6a499db3783b4206aefa334106306ea9929f3dee93ddd3aeb7b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1a4a14b7e9e365dc24db0ebe71b2d40

SHA1
da70f5fceed9380082666f70e89b24697103533d

SHA256
707e193d5c17330f4d37a2c428684721066203ec365297959b765562882db91c

SHA512
dc1ddc82195214df02ac18f1fb48b0f3ea62a46f028871d88d265e4c0df5ac29428e83f8380303a4d81ded767b5be6b44c97ecc40e025e19b12cbfea8eb5e9d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff3ca9d1811014ac34ecbc4bb252af5a

SHA1
2810d647ed592dcbf10415d02c4f864b8334e1aa

SHA256
83cd151dcfc707bdaedb0defade6906546452d3fc7097a10858c54f1e82209c3

SHA512
c3af9a43b71ee2be42c4d77fe6920087c37db8f64ad1e75073a203536b0d3ea48fdc3ed3376b6fdd309792f57653a5db1bfe10d015b9cc28ef60112934a68d19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1a926b0b3f2289cca6b5f996682678a

SHA1
46b6d18af74f15fd0be6fb90e37404f49719330c

SHA256
4925b0e6e4c9fa01536c8f8f8504cb45fcb5d9aef963ca8fe3cbc4d359deea9b

SHA512
edfb9b421958f2495953cde50880c94b259e8e4ad66645eee3a1798cd8642402beee6321421f531603435b2858c0b92c4e6f025ef215167f3c9d4490022734a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47359e7b1ddc63840e40443d2166c60b

SHA1
023a5568fb20073faf4f772451c2ad7d3f5c9594

SHA256
4c55b5512f255591ac140021cac268223bfe276c1e90ccb0bba30963e64b166e

SHA512
a6baa09247b05b9e197e6abd9e94fcb763eaa569573956e34698be152923a765166eeb1fe69546b0cb4ed13dca5e7acd8f7d8f92caf4a1f7cfa9746809e06f7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dfc3f75f74241c45e75b726908b1f24

SHA1
fdcd4058a472e52b7f9bb353d55c8937d7922a4e

SHA256
2eefb892d58ec469dc0ee87e1b3d388588e1cf0e813f4dc26411647d1af13f1d

SHA512
05451c2df1457e3cd9f71cb76c805750a06b7df227f78fa56185489bc25a1f241e4d1600748a11105ecb40e87964a7d53777afc5bc4370a9793d440bd76e6136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\pzrzu69\imagestore.dat

Filesize
1KB

MD5
71d9db286df139398eef9a5922a1cd08

SHA1
04961e7cc44d96c65b59eca079bf64426f61bb1d

SHA256
ab8269c117e620bcd2459189ab2240e8240161f08ea18af783c027813b6705d4

SHA512
bbf1449f9818eff10aa94111c732162f973e900910e3ec0b7533b7f3268d47ebb7c688916f0c7a8015d39b2c2cfabc3b06317734299315c0a098932b239ea9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\favicon[1].gif

Filesize
961B

MD5
a82fa8b53a3c1d89ae58ef564bafcc0e

SHA1
05bec074e07b7087df10bb4169f5ff2d3f5c02ed

SHA256
e2e51743c20e52b7487783022024d88d69aef8a933668277acbb412a9ef2b91d

SHA512
0a095499aabcb7f6b53f9a215cf5d8d295a4f239f1b461b53d6760ac4bef2b98f8c0f2210f2b106aa8c71f150195387a68cbfffdf0111faa29c89ededc38ce1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC8C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCEF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AS5C1.tmp\ATCSMon410.tmp

Filesize
696KB

MD5
8aa8c628f7b7b7f3e96eff00557bd0bf

SHA1
9af9cf61707cbba7bf0d7cbed94e8db91aff8bd6

SHA256
14d4fa3ea6c3fbf6e9d284de717e73a1ebb5e77f3d5c8c98808e40ade359ea9d

SHA512
5e0a4765873684fce159af81310e37b6918c923ccede0c4de0bd1e2e221425109131830cff02e3f910f15b0401ee3b4ae68700b6d29a5e8466f6d4ee1dcd6eeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF4E5AEA3B6B6CDE36.TMP

Filesize
16KB

MD5
8ea138df3f3f4e5b918050f4d122dd94

SHA1
eab8c55d6460751ec026fd3c43e4dcc8ffd3ca2c

SHA256
0c6348f8a56da7ed8d01ab9b5c5c6bcabe1f3b5698abb0a9fc9871f3b5ea6fa6

SHA512
b85501f2bea96e53a9df427244eca45a505f695623c42e7d85ee14acf3fe3d8e71654c70b9a8742a02a44c894c78ca900b4829e00f6608f2a9003a7270d97849

Download Submit
C:\Windows\SysWOW64\comdlg32.ocx

Filesize
149KB

MD5
ab412429f1e5fb9708a8cdea07479099

SHA1
eb49323be4384a0e7e36053f186b305636e82887

SHA256
e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240

SHA512
f3348dbc3b05d14482250d7c399c00533598973f8e9168b4082ee5cbb81089dfaefcfda5a6a3c9f05b4445d655051b7a5170c57ee32d7a783dc35a75fee41aa9

Download Submit
\Program Files\ATCS Monitor\atcsmon.exe

Filesize
2.1MB

MD5
40463cebfb335e86e88c26ecf097ca67

SHA1
4f067d671a4395c1214e56e46fb449f23a1c5028

SHA256
752e4596cec24838d837516a1d9976fa642034c5f169f7919dacd23698a63fe8

SHA512
9ecce39e3c3b370df98d6360356e88cacb27e62ebc1ae279bae54b26ba89c758660336442f5d3c8ecf29821c6fa95cd48e85ba4448a0d689d7ec44f1bd011928

Download Submit
\Program Files\ATCS Monitor\subclass.ocx

Filesize
21KB

MD5
b5539b180fb0029e386d2ec0b969a5c2

SHA1
244cc41eb036e65d616a8210545c70c8181dd450

SHA256
f6a8f50e7c94d458f60b160dfc0e6057dfedbf12529c4b1469626fe559a04fe3

SHA512
021f881620f1d3a1f69d5afeb1e5ef104062762a76cac05350d95fd0b6f0baa1449e17e893613b0e1ad403c346830c81dbb57709b07551b8c851f2014526672b

Download Submit
\Program Files\ATCS Monitor\unins000.exe

Filesize
706KB

MD5
27f52a2dc274f70be102fa53d283b3cd

SHA1
a86e6bd8d85fae4a765fa3c27b154fc9fc11f4ce

SHA256
fc01b834e728c1be919517e0dc67294332c397569e88cd66e840d2e4ce8f2124

SHA512
3ce6bbac2ae2e797efec8ce2a2914f5bfcdf5ece8718b1474e92a5ff9da31d9250772c390f3bd7946c3e538a7548af595f2a67fa35a4f32054daf845d352f4b4

Download Submit
\Program Files\ATCS Monitor\unzip32.dll

Filesize
106KB

MD5
306a2f9edd3ef2d9da4b3b952c7a4e8f

SHA1
87cdb798e32ef43af03ce20dec9e31610396b952

SHA256
5b69c4c2330485c0e97c9260be67feff8cf7b041bad2268eb2f5c8044f559ee4

SHA512
ae6da06a451150b2bc6b7682b582a93f36e7983273cb68edac33f849ec08268036bf9927f9ce941b88b00df284ab27c9dc9becc2fa043ba77861afa93d0b963f

Download Submit
\Users\Admin\AppData\Local\Temp\is-H9NLL.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Windows\SysWOW64\mscomm32.ocx

Filesize
101KB

MD5
2c6119da3993f410e74b15112f840cb0

SHA1
9d7aaffc0bcf955cc75d4ecc228b1ceda8a1856c

SHA256
51a1d6812e445c26c71465e2709e6d1ad587f8513002d662cd160f424f48b37c

SHA512
053ece4eb2ddba51c0d683a7afd439ed88605ab83619de738f7ad2495bfe9e9f16fc3b829c7fc9c779b50f039b9fad66d16aed520a5adfd1522a711073f78208

Download Submit
\Windows\SysWOW64\msstdfmt.dll

Filesize
117KB

MD5
719e0f4d1114f700f564e9ae47f0e3ee

SHA1
d0505b9cb3123e0f2407ab3271f9f2e33d251410

SHA256
3d5c3074fc645da3b68c859a709a5fbefb7df43f458af01ffda55bfc1456e7fc

SHA512
42c555262a9353ccbfd8dcb656a6396a82e5d7b9bacb37134450e3ad866dee06db292b40fd21cad17dd7bba43ed01acf0ba035e4fbf78d762e196de78bfd7748

Download Submit
\Windows\SysWOW64\mswinsck.ocx

Filesize
121KB

MD5
e8a2190a9e8ee5e5d2e0b599bbf9dda6

SHA1
4e97bf9519c83835da9db309e61ec87ddf165167

SHA256
80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

SHA512
57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

Download Submit
\Windows\SysWOW64\richtx32.ocx

Filesize
207KB

MD5
045a16822822426c305ea7280270a3d6

SHA1
43075b6696bb2d2f298f263971d4d3e48aa4f561

SHA256
318cc48cbcfaba9592956e4298886823cc5f37626c770d6dadbcd224849680c5

SHA512
5a042ff0a05421fb01e0a95a8b62f3ce81f90330daed78f09c7d5d2abcb822a2fe99d00494c3ddd96226287fae51367e264b48b2831a8c080916ce18c0a675fa

Download Submit
\Windows\SysWOW64\spin32.ocx

Filesize
56KB

MD5
abd45f4ab3d212c6108e589bc4a81448

SHA1
bb3a6da672dc39157853772336517aa162329808

SHA256
449cf809646a10faa7b6118842d4a06ec61895c2f4a49881beee71799bb4718f

SHA512
fda575f55672ac3d56a6617123d17e7e05103607afeba618f54660511b73eaa70a6fdfdeb8f7dc0de4b15fa603190b012dd840f143c40e1b9be3bc36ca3be896

Download Submit
memory/1040-110-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1040-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1040-16-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1040-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3000-17-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3000-18-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3000-109-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3000-15-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download