Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe
Resource
win10v2004-20241007-en
General
-
Target
3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe
-
Size
126KB
-
MD5
052760d6853b1951bdfa2135830ef310
-
SHA1
d3f21fa13cd9da82fb11bdf8aae06e388d2f99e0
-
SHA256
3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3
-
SHA512
6d7af5743b1092b1fb6d001a061564d9001c554acc8d1c95346a4fb71597aebf4a94b3e31010311f4da72398415e47aaf4b50596dca6726f3eef40e389e6e926
-
SSDEEP
1536:i1qcQMheJwmb0LM9vXBhracIDV4mjRLozHSzDLpPL2SornNwlKaYYgpphPVeOg/n:k9hY0wYr2bS/LfoxwlKaovVkqW9f
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:\users\admin\appdata\local\temp\3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3n.exe = "c:\\users\\admin\\appdata\\local\\temp\\3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3n.exe:*:Enabled:SMPN" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wdfmgr = "c:\\windows\\wdfmgr.exe" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msrpc = "c:\\windows\\msrpc.exe" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wdfmgr\ImagePath = "c:\\windows\\wdfmgr.exe" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdfmgr = "c:\\windows\\wdfmgr.exe" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\wdfmgr = "c:\\windows\\wdfmgr.exe" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsassv = "c:\\windows\\lsassv.exe" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\q: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\j: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\g: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\e: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\n: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\i: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\t: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\p: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\z: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\y: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\x: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\w: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\u: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\k: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\h: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\v: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\r: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\o: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\m: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened (read-only) \??\l: 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\regedit.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created \??\c:\windows\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\AdobeLoader.scr 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened for modification \??\c:\windows\mui\olefx.dll 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened for modification \??\c:\windows\mui\rctfd.sys 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File created \??\c:\windows\msrpc.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened for modification \??\c:\windows\msrpc.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened for modification \??\c:\windows\regedit2.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened for modification \??\c:\windows\lsassv.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File created \??\c:\windows\calc.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File created \??\c:\windows\Start Menu\Programs\Startup\AdobeLoader.scr 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File created \??\c:\windows\wdfmgr.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened for modification \??\c:\windows\wdfmgr.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File created \??\c:\windows\lsassv.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File opened for modification \??\c:\windows\calc.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe File created \??\c:\windows\regedit2.exe 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "25930" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-t..nalservices-runtime_31bf3856ad364e35_6.1.7601.17514_none_3b05f4d3e2a0703c_winsta.dll_4e6f9a4e" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "98765" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "56519" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-nap-oobsha.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5ad997a8f8e6c88d\\msshavmsg.dll.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-w..ewmdrmcompatibility_31bf3856ad364e35_6.1.7600.16385_none_090727b340445c97\\portabledevicewmdrm.mof" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "101757" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Program Files (x86)\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\PolicyDefinitions\\en-US\\CredentialProviders.adml" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f6a00d30a34ae11a\\apphelp.dll.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "71549" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "88243" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "13978" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "27792" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\servicing\\Packages\\Package_for_KB976902_RTM~31bf3856ad364e35~amd64~~6.1.1.17514.cat" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\DriverStore\\FileRepository\\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\\Amd64\\EP0LVRA9.DLL" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWOW64\\wbem\\it-IT\\WmiPerfClass.dll.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "62083" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-diskdiagnostic-adm_31bf3856ad364e35_6.1.7600.16385_none_b8b9f3bcc473892a\\DiskDiagnostic.admx" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-maintenancediagnostic_31bf3856ad364e35_6.1.7600.16385_none_e5e3f53c23550761\\RS_UserWERQueue.ps1" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "89674" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "40405" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "48013" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Program Files (x86)\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\onexui.dll" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\it-IT\\notepad.exe.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWOW64\\it-IT\\rasplap.dll.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWOW64\\wbem\\wzcdlg.mof" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_prnca00c.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_928ddfae8716e27f\\CNBBR323.DLL.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\PolicyDefinitions\\StartMenu.admx" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-p..sions-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_194039000e7ad3f0\\PreviousVersions.adml" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-sctasks.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0bb7e1a52cbf32c3\\schtasks.exe.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_wiaca00e.inf_31bf3856ad364e35_6.1.7600.16385_none_9bdaf7e8cb1745bc\\CNFRA6.ICC" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\es-ES\\wshext.dll.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-d..owmanager.resources_31bf3856ad364e35_6.1.7600.16385_en-us_05ee2d61d58171a1_dwmcore.dll.mui_ebf60d96" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\DriverStore\\FileRepository\\mdmarn.inf_amd64_neutral_fa693d8797766f49\\mdmarn.inf" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\en-US\\napinsp.dll.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWOW64\\it-IT\\irclass.dll.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Backup\\x86_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_accc80812c85f01f_dhcpcmonitor.dll.mui_478a7103" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "9698" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-m..owfilters.kstvtuner_31bf3856ad364e35_6.1.7601.17514_none_8d3b6ca8a0917ca2\\vbisurf.ax" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "76029" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Manifests\\amd64_circlass.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b4b7bd75a240b053.manifest" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\1040\\alinkui.dll" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_cpu.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_53476b155eec25b4\\intelppm.sys.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\Fonts\\RAGE.TTF" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "88435" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d3dd093ad06026e1.manifest" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "107344" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "14035" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\ja-JP\\about_Comparison_Operators.help.txt" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "11439" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "60303" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "99117" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\PolicyDefinitions\\es-ES\\sdiageng.adml" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\\403-7.htm" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_it-it_42a55ec43db85af9\\adtschema.dll.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "80251" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "106044" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\es-ES\\helppane.exe.mui" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWOW64\\dui70.dll" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "59967" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\servicing\\Packages\\Win8IP-Microsoft-Windows-DownlevelApisets-Shell-WinIP-Package~31bf3856ad364e35~amd64~hr-HR~7.1.7601.16492.cat" 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe"C:\Users\Admin\AppData\Local\Temp\3de76f40f5f09bbfac7d73d099dfec5508c507c67723b3b5dcc87b3246358fb3N.exe"1⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2096
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
4Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD59a7abf0b50b262dd799886182413d037
SHA17fce224e02e6df3d774f3040110ed53a8afd8fa7
SHA256daba259cbc55db97e8bcc01848310c02ab44ec34d34db4bab3db5eda96f2456a
SHA5129e1ed7abb6e9722c0518ccca2c86b73e03b7a15e808623193078a0cf8ef8502a36faea101f0335e1f2d54252d5707301d43cd98808f2836f4999a879b6356191