a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626f

Analysis

max time kernel
106s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Size

1.9MB
MD5

7a0b8ea8a4c9566d3eda175e8cf02250
SHA1

14525b4aaa093ccd5a0b0e46f349d8c2cf1a3679
SHA256

a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626f
SHA512

ab1ee2ce4c368e826225a7ffeebb88779bcbbdb2ac44742154812780e49ff1f3bfe81d18b39fbfd4b619596e153e609d33549706f3380850abf3dc0af11a9c6a
SSDEEP

49152:B/MFurieeeaBeHighOrR02axTAZ81BAmontq/OoW:B8ur3YvbVDaxTAZ81BAmong/OoW

Score

7^/10

discovery persistence privilege_escalation upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023cbe-88.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 5 IoCs

pid	Process
2108	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
2108	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
2108	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
2108	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
2108	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\npgrweb5.dll	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
File created	C:\Windows\SysWOW64\npgrcom5.dll	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
File created	C:\Windows\SysWOW64\grcht50.dll	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
File created	C:\Windows\SysWOW64\gren50.dll	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023cbe-88.dat	upx
behavioral2/memory/2108-92-0x00000000740F0000-0x0000000074580000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF39550B-2A23-418A-ACEC-812C70EA5A62}\TypeLib\Version = "5.8"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0574ABEB-B0DA-465D-9EB7-286C00F3628F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0574ABEB-B0DA-465D-9EB7-286C00F3628F}\TypeLib\ = "{D4B725AF-F3AF-49C6-8935-B0471AD28E86}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Interface\{D09EDC75-0A19-52C9-8253-4BAF102469AA}\ProxyStubClsid32	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28845384-ED9F-4D2E-986E-D52AC37A108F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\MIME\Database\Content Type\application/x-grplugin-printviewer\CLSID = "{B7EF88E6-A0AD-4235-B418-6F07D8533A9F}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{3C19F439-B64D-4dfb-A96A-661FE70EA04D}\MiscStatus	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4ACA069-B92C-401A-B175-354E00D538D9}\ = "IGRLine"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83CC68EF-B558-45BB-8023-6C4F3BDADA7B}\TypeLib\ = "{D4B725AF-F3AF-49C6-8935-B0471AD28E86}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81727F33-8D8C-45DC-B525-07ABDC5FB652}\TypeLib\Version = "5.8"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{CB45DFE5-6C35-4687-B790-FEC65D512859}\VersionIndependentProgID\ = "Rubylong.GRDisplayViewerPlugin"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{B7EF88E6-A0AD-4235-B418-6F07D8533A9F}\MiscStatus\1\ = "131473"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\Interface\{D09EDC75-0A19-52C9-8253-4BAF102469AA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A246AC9-1715-40B6-A483-DE9F3E8DA43C}\TypeLib	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F803AE1D-B578-490A-A1FE-38976AD2B625}\TypeLib\Version = "5.8"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Rubylong.GRPrintViewerPlugin.5.8	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{B7EF88E6-A0AD-4235-B418-6F07D8533A9F}\ = "Report Print Viewer Plugin - plugin for Grid++Report print viewier."	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{CB45DFE5-6C35-4687-B790-FEC65D512859}\ProgID	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4ACA069-B92C-401A-B175-354E00D538D9}\ = "IGRLine"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4ACA069-B92C-401A-B175-354E00D538D9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04CEA260-DD00-4954-A81F-F0A201343CB9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{CB45DFE5-6C35-4687-B790-FEC65D512859}\ = "Report Dsipaly Viewer Plugin - plugin for Grid++Report disply viewier."	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE9AA791-4C55-4E06-A592-08D8DF88A941}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B753063D-AEBA-4E5E-B53A-F89B68F1F622}\TypeLib\ = "{D4B725AF-F3AF-49C6-8935-B0471AD28E86}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60EB191F-5E63-41E7-808F-C66EC7A8EF26}\TypeLib\Version = "5.8"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77FD1006-7067-41FF-A712-0F356A6ACE8C}	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C04A6148-7511-41EF-8062-BD89A0A92D40}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B23325-7316-4098-9FE3-B5A1C24DB296}\ProxyStubClsid32	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60EB191F-5E63-41E7-808F-C66EC7A8EF26}\TypeLib\Version = "5.8"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5D15E31-FA9A-42BE-BE9C-8688E7D9D6A0}\TypeLib	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{273631DD-1CAC-49E9-92EE-584F48921A1E}\TypeLib\ = "{D4B725AF-F3AF-49C6-8935-B0471AD28E86}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\Interface\{02052725-77ED-5A35-B723-BE3AAA8FA656}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDAA7F5B-E100-49B7-93F2-6B66FC93BE55}\ = "IGRSubReport"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E3F088-FE25-4896-AA9B-CC100FDD460B}\VersionIndependentProgID	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04A6143-7500-41EF-8062-BD89A0A92D40}\ProxyStubClsid32	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDAA7F5B-E100-49B7-93F2-6B66FC93BE55}\TypeLib\ = "{D4B725AF-F3AF-49C6-8935-B0471AD28E86}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3BB506AB-425B-43B0-BC82-28A61FCCF686}\TypeLib\Version = "5.8"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A246AC9-1715-40B6-A483-DE9F3E8DA43C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04A6148-7511-41EF-8062-BD89A0A92D40}\ = "IGRRichTextBox"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23F65787-D22B-4CA6-BA49-D22B63CA353A}\TypeLib	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48636E6A-758E-46C0-B37A-C2A2CAC9469A}\ProxyStubClsid32	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97502458-7024-4194-9598-5B62001D8C1A}\ProxyStubClsid32	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B2CC2C43-CF42-4E38-BDBB-5C04DF11793F}\ = "IGRReportFooter"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBF161F0-F347-441A-9C0D-0ACA7824793B}\ = "IGRE2CellOption"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Rubylong.GRDesignerPlugin\CurVer\ = "Rubylong.GRDesignerPlugin.5.8"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Interface\{02052725-77ED-5A35-B723-BE3AAA8FA656}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{3C19F439-B64D-4dfb-A96A-661FE70EA04D}\MiscStatus\1	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_CLASSES\WOW6432NODE\CLSID\{B7EF88E6-A0AD-4235-B418-6F07D8533A9F}\PROGRAMMABLE	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39A2C13A-D695-44BD-8339-A94FA64CB62B}\ = "IGRMemoBox"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF39550B-2A23-418A-ACEC-812C70EA5A62}	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2F421D7-73FA-462F-9BF5-7DA3E512CA00}\ProxyStubClsid32	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3BB506AB-425B-43B0-BC82-28A61FCCF686}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Rubylong.GRReportPlugin\CurVer	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{CB45DFE5-6C35-4687-B790-FEC65D512859}\TypeLib	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83CC68EF-B558-45BB-8023-6C4F3BDADA7B}\ = "IGRColumnTitleCell"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04CEA260-DD00-4954-A81F-F0A201343CB9}\ProxyStubClsid32	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Rubylong.GRPrintViewerPlugin\CLSID\ = "{B7EF88E6-A0AD-4235-B418-6F07D8533A9F}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Interface\{5052A2CB-46C8-5BD7-B64C-465B80FFAC89}\TypeLib\ = "{EDF08BB6-DCC4-5F28-A78E-AE7DB0898C7E}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{3C19F439-B64D-4dfb-A96A-661FE70EA04D}\TypeLib	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24DE1EBE-5D9C-40EC-A11A-21AF7D0C0D36}\TypeLib\ = "{D4B725AF-F3AF-49C6-8935-B0471AD28E86}"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3112650-36D2-4928-9D6C-C0A21CCC1EBA}\ProxyStubClsid32	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01056F48-F4AB-4D9F-BE45-614F3313717D}	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{B7EF88E6-A0AD-4235-B418-6F07D8533A9F}\VersionIndependentProgID	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23F65787-D22B-4CA6-BA49-D22B63CA353A}\TypeLib\Version = "5.8"	a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe

C:\Users\Admin\AppData\Local\Temp\a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe
"C:\Users\Admin\AppData\Local\Temp\a795cccfd7a9a219412e630b63851534d1d69cc1baaa0448d8645a2a7031626fN.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd9A7D.tmp\InstallOptions.dll

Filesize
15KB

MD5
f00baffebf7cdda9b3f7c4aab55159bb

SHA1
7a2a2a994f391abd5cca7b3f2fbac98299914dfb

SHA256
9b81f4a1710cc84bd2f8896e738f4c1589648faed8632c7ebfae51df23813eeb

SHA512
1ad68e443d94be1c734852f7841d74a0975cf38ad88b071fdf4f4bf9927b66e9fcf544cd77207748a7b895a87b656aa5442ef918f14b22959e208074c9e274cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd9A7D.tmp\LangDLL.dll

Filesize
5KB

MD5
996bd0bdcb847d06ea391bf1ce4c6bb8

SHA1
e611aec325139c322922d88cccb72cb5e2d64029

SHA256
0269940a0088dc3b01ab7f291bac6015d8e3474498ce66460a546f7ece598f38

SHA512
5140ecfef8bcd2dcb12a94052a4256d2284bd2a97acae3d97e805fd197285d3bf68aebc3b5e791b08a22a5144660376aa000386ddd556e0b77fd5e42833cece1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd9A7D.tmp\ioSpecial.ini

Filesize
1KB

MD5
efcaee2a896f1e8452976a1acbb4579a

SHA1
a29aa736bc153be1b900ac6eea55c9f0961e914a

SHA256
3ac79eb795b5d5893be60fd4f3d6856a46891bc0877896660346e926c1a495cd

SHA512
c40f0ad5064b174b594962b6079821a80fb6f17fa72877326f5e7917f54f73f5bffac928c154612750d1441f3e63aed19ac26be9534b01d9e2d6b152f3ff42e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd9A7D.tmp\ioSpecial.ini

Filesize
1KB

MD5
fc3e8337529a36597abfe43b38d8845f

SHA1
c2b54e606a71197453f8e1ee2d139068e5768caa

SHA256
a166900902abe789cc55a9246796a8da69019f27b2b57ef07a2a23f8d128c443

SHA512
b0dfa85389021111b5ad41ded1ae799ef71e52e9ea1cb08c9fbb13e5452c7c262634c0c1827ce45674e2d65803ea26bb0ce224b177e1d87613005c5febb6418b

Download Submit
C:\Windows\SysWOW64\npgrcom5.dll

Filesize
265KB

MD5
d5568e94377a419c717cacf177dfd13b

SHA1
3a66cb516d59c88ce96037613c3cf53ed00cdeac

SHA256
02f729cbe64157f0bf93e45b4bc336b66406e1b8a4220dc7ea71dfe299af5bd7

SHA512
c37205a813608eb569afe36905c3141bc99b6f142f9ac0c1f43e145bd3ff64c6dcc0a1a0c2c4adcaf08504982411475f10616ecff2ec24fc811f0926e164b621

Download Submit
C:\Windows\SysWOW64\npgrweb5.dll

Filesize
1.8MB

MD5
9ed8e72d9e9d75fcd8f52b04c65a6d8b

SHA1
86c787ed723562ca6538f27396b103edc1ed7904

SHA256
512bc3780ee690009a803738ba08a8a912f3c49c05f5b6eadcf3fcc256139a75

SHA512
23928b4146481b55ab07991560494175f83fa9184f1b50e8d4908a28926437644362362e6a8468359acd00f4c3b489895dd9f66756b17152650417828be676ed

Download Submit
memory/2108-92-0x00000000740F0000-0x0000000074580000-memory.dmp

Filesize
4.6MB

Download
memory/2108-97-0x0000000003D00000-0x0000000003D42000-memory.dmp

Filesize
264KB

Download