3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
Size 313KB
Sample241111-p52eksymaz
SHA256 3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b
MD5 bd372e095c037675ea4171add0520462
SHA1 697a203cb99b4242d067d78860fac36d73644892
SHA512 b2111d5ae527ae91a62aea3f307ed94a81b8af09dacfed1bdb1386b65ab459b8642fb3b93560bd54f87b99a9339c3904c1985368418a14615a40978e54ca5a4a
SSDEEP 6144:ueHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:uyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\YHN8O2C\\KDJ2S8C.exe\""	system.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\YHN8O2C\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe

Executes dropped EXE 5 IoCs

pid	Process
4572	service.exe
4844	smss.exe
3788	system.exe
2692	winlogon.exe
3816	lsass.exe

Loads dropped DLL 3 IoCs

pid	Process
3788	system.exe
3788	system.exe
3788	system.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sHN2Y5G0 = "C:\\Windows\\system32\\MHG8N4IJNW6S6R.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0S8CNW = "C:\\Windows\\DGQ2Y5G.exe"	system.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\Z:	service.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MHG8N4IJNW6S6R.exe	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\SysWOW64\TRV3D1O.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L\MHG8N4I.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\MHG8N4IJNW6S6R.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\TRV3D1O.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L\MHG8N4I.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\TRV3D1O.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\TRV3D1O.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\TRV3D1O.exe	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\MHG8N4IJNW6S6R.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L\MHG8N4I.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\TRV3D1O.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L\MHG8N4I.cmd	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\MHG8N4IJNW6S6R.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\MHG8N4IJNW6S6R.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L	lsass.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L\MHG8N4I.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\MHG8N4IJNW6S6R.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L	service.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\FTV3Y4L\MHG8N4I.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b9b-156.dat	upx
behavioral2/memory/3788-314-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\YHN8O2C\regedit.cmd	service.exe
File opened for modification	C:\Windows\YHN8O2C\smss.exe	service.exe
File opened for modification	C:\Windows\YHN8O2C\KDJ2S8C.exe	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\YHN8O2C\regedit.cmd	winlogon.exe
File opened for modification	C:\Windows\JNW6S6R.exe	smss.exe
File opened for modification	C:\Windows\YHN8O2C\XDX3E1U.com	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\YHN8O2C\winlogon.exe	system.exe
File opened for modification	C:\Windows\YHN8O2C	system.exe
File opened for modification	C:\Windows\YHN8O2C	smss.exe
File opened for modification	C:\Windows\YHN8O2C\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\YHN8O2C\service.exe	winlogon.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File opened for modification	C:\Windows\YHN8O2C\XDX3E1U.com	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\YHN8O2C\system.exe	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\smss.exe	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\XDX3E1U.com	winlogon.exe
File opened for modification	C:\Windows\YHN8O2C	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\service.exe	smss.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\regedit.cmd	system.exe
File opened for modification	C:\Windows\YHN8O2C\smss.exe	system.exe
File opened for modification	C:\Windows\YHN8O2C	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\YHN8O2C\winlogon.exe	service.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\DGQ2Y5G.exe	service.exe
File opened for modification	C:\Windows\DGQ2Y5G.exe	smss.exe
File opened for modification	C:\Windows\JNW6S6R.exe	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\moonlight.dll	service.exe
File opened for modification	C:\Windows\YHN8O2C\system.exe	smss.exe
File opened for modification	C:\Windows\YHN8O2C\XDX3E1U.com	system.exe
File opened for modification	C:\Windows\YHN8O2C\smss.exe	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\YHN8O2C	winlogon.exe
File opened for modification	C:\Windows\YHN8O2C\KDJ2S8C.exe	smss.exe
File opened for modification	C:\Windows\YHN8O2C\service.exe	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\service.exe	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\DGQ2Y5G.exe	lsass.exe
File opened for modification	C:\Windows\JNW6S6R.exe	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\XDX3E1U.com	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\smss.exe	smss.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\system.exe	winlogon.exe
File opened for modification	C:\Windows\YHN8O2C\KDJ2S8C.exe	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\system.exe	system.exe
File opened for modification	C:\Windows\YHN8O2C\service.exe	system.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	system.exe
File opened for modification	C:\Windows\cypreg.dll	winlogon.exe
File opened for modification	C:\Windows\DGQ2Y5G.exe	winlogon.exe
File opened for modification	C:\Windows\JNW6S6R.exe	winlogon.exe
File opened for modification	C:\Windows\YHN8O2C\regedit.cmd	smss.exe
File opened for modification	C:\Windows\YHN8O2C\regedit.cmd	lsass.exe
File opened for modification	C:\Windows\YHN8O2C\system.exe	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
File opened for modification	C:\Windows\YHN8O2C	service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2580	3788	WerFault.exe	87
1988	3788	WerFault.exe	87
4208	3788	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
4572	service.exe
4844	smss.exe
2692	winlogon.exe
3788	system.exe
3816	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4572	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	85
PID 2008 wrote to memory of 4572	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	85
PID 2008 wrote to memory of 4572	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	85
PID 2008 wrote to memory of 4844	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	86
PID 2008 wrote to memory of 4844	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	86
PID 2008 wrote to memory of 4844	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	86
PID 2008 wrote to memory of 3788	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	87
PID 2008 wrote to memory of 3788	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	87
PID 2008 wrote to memory of 3788	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	87
PID 2008 wrote to memory of 2692	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	88
PID 2008 wrote to memory of 2692	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	88
PID 2008 wrote to memory of 2692	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	88
PID 2008 wrote to memory of 3816	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	89
PID 2008 wrote to memory of 3816	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	89
PID 2008 wrote to memory of 3816	2008	3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe	89

C:\Users\Admin\AppData\Local\Temp\3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe
"C:\Users\Admin\AppData\Local\Temp\3ab746224034868cbc69a2a474589c4fe3d1a3e9b494ee276d692aa97ce8859b.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\YHN8O2C\service.exe
  "C:\Windows\YHN8O2C\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4572
- C:\Windows\YHN8O2C\smss.exe
  "C:\Windows\YHN8O2C\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4844
- C:\Windows\YHN8O2C\system.exe
  "C:\Windows\YHN8O2C\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 1380
    3⤵
    - Program crash
    PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 1388
    3⤵
    - Program crash
    PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 1404
    3⤵
    - Program crash
    PID:4208
- C:\Windows\YHN8O2C\winlogon.exe
  "C:\Windows\YHN8O2C\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2692
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3788 -ip 3788
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3788 -ip 3788
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3788 -ip 3788
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

DGQ2Y5G.exe

Path C:\Windows\DGQ2Y5G.exe
Size 313KB
SHA256 49739dc6c520093b8ccf34cb06b8987354e36e0a7e8ba5dba1bb6c55fd1a1aa8
MD5 1cc826448cf9163cd41c64ccde4e2cb3
SHA1 d26e4f9405d704064288f01feda21053804518b4
SHA512 a20e0e47375cd22fcfb3595a25cd95340cdc81c1f37c8589438041af8dbe707d6e659be7626e589c145b7e140421d946b1ad7b5aed97bc32cf7842c283bf3ed3
SSDEEP 6144:WeHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:WyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

JNW6S6R.exe

Path C:\Windows\JNW6S6R.exe
Size 313KB
SHA256 1cb4026142be72f6437039a5185ef2809495da404272a785f1a91034b0af8188
MD5 bdf2927626b061514e4c696eaf8fde74
SHA1 cc61eab7bac0807a3f40e6d730056397e0fbe9bd
SHA512 868d2af3b2f1f1feaea26b82ec2640394d074725faf932ab71ae77a67138aa9d1ec29c1a5a33aafdd7643ae2ecaf93ab71a2dff8e90f29d030a394fbc1c70c53
SSDEEP 6144:heHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:hyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

MHG8N4I.cmd

Path C:\Windows\SysWOW64\FTV3Y4L\MHG8N4I.cmd
Size 313KB
SHA256 547649e6c8c49ef45874ae871edeccdf8c05e7e914baa65eb3bd352ab646a94e
MD5 75fbc65ea0c44506da070473e447bbb4
SHA1 741c036d7cdd737d07cfb8c6dca51960fa338f0a
SHA512 8172fc9f43dac11f03e5b48a32b3208c188f0aa8076c09ef20008d0c0f2f3069c3517c121e5d1233728f1bf37aa8fa3f90bfdcf5fe77196c998cd1b2d2688d00
SSDEEP 6144:PeHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:PyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

MHG8N4I.cmd

Path C:\Windows\SysWOW64\FTV3Y4L\MHG8N4I.cmd
Size 313KB
SHA256 daa6646a4177d8a23a245e93be53215e72e0b2a8176f4e0c19903d136bdb0622
MD5 8e42cccf0e20cd52109e924af79dcfe6
SHA1 83dbae88ea6cecdfdaf60dd4968cd150a072e55e
SHA512 c77aab6f2880745e754fa93b12de94188f6556b15c946e4d614558727678980a23747f1d49ba6b7d9447e0fa370f8023db7fec513450b24882761471655b7c07
SSDEEP 6144:ReHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:RyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TRV3D1O.exe

Path C:\Windows\SysWOW64\TRV3D1O.exe
Size 313KB
SHA256 17541ff72f845a86cf09a0a780907541a31e435d5fa8d7265daff19c4727c355
MD5 3b90ef6d1b1efc0ee0df0dff37ebad38
SHA1 215fdb06ddf8123ad1d9626f0bd9ed6e9ca514e7
SHA512 04700d5090133ec689ac46b29728781a97bd20d51ce68ebbad763eb997c0ece346b0d7dfb582f3187d7c8970dece49774fef86114636095d620addb190ea7b16
SSDEEP 6144:aeHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:ayMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

systear.dll

Path C:\Windows\SysWOW64\systear.dll
Size 127B
SHA256 c3daefdcdbcf0ff577bd90db174d73edaa695a3b67f3b0c9172f3c312d0c2f19
MD5 b1aa8b94fd2e63976f76e7b4d7442096
SHA1 a784f82ddb6d4224b439e5a1a9dbaec07c8117a6
SHA512 8368e075dc95bed89f0323e5aaae5460849e3a728036511eb3a2ea4f03fd30f04889a5e011cdf651e1501b70436f636b628f43dc1b93891469bbd95fc66cea4d
MD5 SHA1 SHA512

Submit Download

systear.dll

Path C:\Windows\SysWOW64\systear.dll
Size 141B
SHA256 a3ba19b213288fbc488c7c5f2297a3d7fb0e7fa761fb5af5449e48e0bb9dd9a9
MD5 ccb3184b58042f65dd286537a27be62d
SHA1 21f8f7cd47e45c2dae9893ccf4e5d2bf5ab0650e
SHA512 dba0475660df23cc2a11cfdccece8d63ebd92749b9f32ed9e18da0ae7f6030150f571c4573501a43ed4cebda297cbebd77f77ade30bff97656dff1aae9a8330c
MD5 SHA1 SHA512

Submit Download

KDJ2S8C.exe

Path C:\Windows\YHN8O2C\KDJ2S8C.exe
Size 313KB
SHA256 04cfcf8e451a9b0231c5063ca8507e4bed6489f0fb01367bea2cd3619caf4fd6
MD5 ae5dedb6b5e3daac9a39d19e2812eb1b
SHA1 ae1e253523a0f293e5b739aab90ada57abe3eb30
SHA512 1ff9ba9b7d8eda5425d8d3b21a0164e9afed2e839f6b36856c1dcb5b9225cfe100c0db0e0c64ec272bc2f866450a07fa58ef05e441fdaf705155c72565364666
SSDEEP 6144:neHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:nyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

XDX3E1U.com

Path C:\Windows\YHN8O2C\XDX3E1U.com
Size 313KB
SHA256 43f8142434e77cd84043829e4c05c4ddda5930f202396d3115008fdd770c57c3
MD5 f0db78a6b00f01f9f89cc55302e772a0
SHA1 031a0bdec48375c324829c9d6a8132be5c36b3ce
SHA512 2ae3389cfb52c8d87459393340c0dcd07b423d7166b69ee954c26a5c5806522d051be66f5c1129b2397611f66fa6631d389f96c924b4a36c752b492cc796db8d
SSDEEP 6144:LeHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:LyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

regedit.cmd

Path C:\Windows\YHN8O2C\regedit.cmd
Size 313KB
SHA256 2b538620d691745805591295b469866a63c35c5a6b581a5a0f976884c8bbde4d
MD5 9c779d1d362a96d569ad44607284a1f4
SHA1 30d9af11e4fef2b199a3ad521de718f1cf158224
SHA512 979ad6e2c3a1080cf63c8a50e7ce410147da0c5f4b2a3c5c302767bc870a560f595a52d66197e9c501017eefd96f0e2650bef1271ef51081a2aa978ba2c2df0b
SSDEEP 6144:+eHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:+yMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

service.exe

Path C:\Windows\YHN8O2C\service.exe
Size 313KB
SHA256 c936ae12e9ef151c7fbe57be25184fccc92bcc6ccbd75eab67f2c1d2fee5164a
MD5 1edb736c351db3b75a27c5f83ef780b8
SHA1 fa8f6029460143d56855fbd66eab9fbeeaf9cbff
SHA512 1b29b1e90c261be0e1c8b30df9d5f7afe24a455a2cd64f03ed2bbca915dec4b6b3b3358e2bce6ade6c589684d60633635a2b7dec98d517df7b81209bbcf83f76
SSDEEP 6144:IeHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:IyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Windows\YHN8O2C\smss.exe
Size 313KB
SHA256 16ba71a8dc7ae99aac9a4c8a0c0bec44ce306dd035f61f2e0f438a6cd1339c0a
MD5 368235db7f39ee8a096397c1bbdc51ac
SHA1 2349aaf298e40c9bcee59accd7049e6a05e57d1f
SHA512 a9c91269e70612997d4ac0113e056386d94eb9466fdcc7d335f50ac9795997d3ce33a499ed0f1968f12bb75371ba3a6028b615c5c74809cd6f28d44e0277cc8d
SSDEEP 6144:0eHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:0yMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\YHN8O2C\system.exe
Size 313KB
SHA256 389cb54684a1682a9f46b8bc538df4ce31a33de8f2314364735b9a70450f94d5
MD5 199c63ea5c0db458d15522c47a5f629f
SHA1 17a8610280618ec3710d76ca67f2bec4602616c5
SHA512 29d2b92435d6d47661e895ef2d140a81d9038512d8d939fcf92f47090480edc4cd267f4b09e111f239203050861ab74f0eb0367028c056e6f3b4a3ab7142055b
SSDEEP 6144:seHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:syMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\YHN8O2C\winlogon.exe
Size 313KB
SHA256 4de8c23e832a45f00a5f09599346bd9d55b2c783ee7d4bceb1c38bf008113862
MD5 4487d18c55215cb3283c1e7a42922553
SHA1 c0751e09a543d04380a20968a67b1aae1d719395
SHA512 c4fc8fdbfb3f6d54accec62d5e6563b3494dd18e81c55177617824fba4437fd93af92cf42e0764a58ae5e1609de6ad910531f6c4a50d5a9bd73dadeba6e865f7
SSDEEP 6144:VeHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:VyMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

cypreg.dll

Path C:\Windows\cypreg.dll
Size 361KB
SHA256 b73e8cf25db9683d28cca18b3db91fefa1f8c1f6c06bcb0ff1855c9ca3e498f3
MD5 c5c7392dc94c13ef23f98cb3729bf711
SHA1 404d820f4b62462eb932275e3b58a1be42896e7c
SHA512 7153bfab3578b60732b0f86fef10bbb722e978124b1d71c58373e8dfbf3a989983314ab63b40ef99722c42d12da2a28955c770d0f1223993145fd9246ff0cc43
SSDEEP 6144:S8sKRApdUu4oMD/AMv2KBiKQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2:9sIOdYD9+KnQRZ66z24VZbdrpgrXN2LS
MD5 SHA1 SHA512 SSDEEP

Submit Download

cypreg.dll

Path C:\Windows\cypreg.dll
Size 361KB
SHA256 1112c19bd06e331ad2a4ce38c0742528f9b92b6f1c7a757d38f32a83e26cf58e
MD5 45c87e723ef890963a244048007fafab
SHA1 724b8494460f10a8be3773aca69a904b1f9f6054
SHA512 2fc969800f75b0ccd27a2c7817423ed81bd56e5eff03329ee485a5ca413c8d934614c32cf9b67b2b6d1e6312f0ae2030577987b7112945c7194efa3969376727
SSDEEP 6144:G8sKRApdUu4oMD/AMv2KBiKQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2:5sIOdYD9+KnQRZ66z24VZbdrpgrXN2LS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Windows\lsass.exe
Size 313KB
SHA256 ccf00aebd5c07adf6dc73cad4753fc968616dacb98d0747b238a6e32301aefbc
MD5 358fb25d257acb22ebc6d86621d8ce7d
SHA1 276265d5b41f59d584cb313ab2ab1ceb5579f8d0
SHA512 00ba198737ccdcb3c71c664e33e022ea9260652ae3de79996147219f361c9c5b214aeffa260a3b293be2ad6689e50251334e7c95eef3bf6b5388bd6735d490d0
SSDEEP 6144:5eHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:5yMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Windows\lsass.exe
Size 313KB
SHA256 c0166599756f9d522f65183cf57b98aa999633641b361bf7938b7bb609283c9d
MD5 06b5ea9ddc5503d52137fb909cc0210f
SHA1 d8bf80712eff604ab2843b9627c5f2e5cdae38d3
SHA512 2b2956b890b0d87ee7aeffbc85eb8077c893763c29ea78a0db3bb76f3025b4013986b70a4e6e0030771b4823032a01a11f3da5bbc0fd72daffb4bb91fd78ab50
SSDEEP 6144:beHwXUU5EYCTvaBjDjWrLJKuKnGML5NjcxV:byMUusvalag5NjaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

moonlight.dll

Path C:\Windows\moonlight.dll
Size 65KB
SHA256 dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7
MD5 8e6e31f8df128a746ff9a3a38f8f78c0
SHA1 e4da9aa336eb7e254592e585b29d8b4e23f3e4bd
SHA512 eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6
SSDEEP 1536:i3C8wUcw1dwm8qlwn4iEv72oIY6bGkPwTufpXeTVZR3AWgCuNjC2WIm:o0UXEfhEYbzPCTVZR3AWijGn
MD5 SHA1 SHA512 SSDEEP

Submit Download

onceinabluemoon.mid

Path C:\Windows\onceinabluemoon.mid
Size 8KB
SHA256 c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae
MD5 0e528d000aad58b255c1cf8fd0bb1089
SHA1 2445d2cc0921aea9ae53b8920d048d6537940ec6
SHA512 89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116
SSDEEP 192:aw5g2v7GlPpvri75iBj2hE0E7D8B+QUTvjkf:aw59Dytri75iBSLAQ7UTvIf
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\system\msvbvm60.dll
Size 1.4MB
SHA256 104fcb338da8345db51670d5f8f60c4041ea2ab55ea48c18d408866afddfd5d9
MD5 c79ec3a7a2675b90e0c9af40f8d1cab8
SHA1 ec1d7cd4b3b2ecee295e178d4b0bc6afe16b4deb
SHA512 dded4fa9b47f4e1e31639c3c5f20474cc94b634ed757ccc2da449619a2fa63dc8a5c59160279ec1458ac6160123f061f798f5a97798cbecb5df78873aa8be736
SSDEEP 24576:2NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:2NQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\system\msvbvm60.dll
Size 1.4MB
SHA256 3b1c71df9d43db5fabd341be8a6b6db4a5a4f863e170b05ac84542ed3ebf901b
MD5 4cf6c0dcb4038810477df88465dd8ca7
SHA1 03383466c38a184d816b9efbc838a1f958c40600
SHA512 23dbd10c216bfd3e2e1555fa057bd4be8b12c8c4750a0cab86a5b56bfba48eb932dd8c3b740ca6685b937ca0131425f94c765c064c6e2b73e3536f44c092e8c1
SSDEEP 24576:7NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:7NQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\system\msvbvm60.dll
Size 1.4MB
SHA256 e13fb59a98f3d4bc9f1826c79dd36e53b587b7353823dd952183f0f3502725da
MD5 f45f8d9fa3e4b3cec0d13e83ab9efaee
SHA1 05a098f8a554143aabcdb839afd82d5ca3923b55
SHA512 71c2bf5214e36d1d38726a466b43e8e43319e47ca58483e18ee71d289baa4198f9d6a271e5a9cf66fdfbbdabd3dfc31768e750a262fd008f5bc3fc1eaca3caad
SSDEEP 24576:xNqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:xNQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2008-0-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2008-266-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2692-311-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2692-123-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/3788-310-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/3788-87-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/3788-314-0x0000000010000000-0x0000000010075000-memory.dmp

Download

memory/3816-265-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/3816-312-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4572-63-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4572-308-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4844-309-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4844-74-0x0000000000400000-0x000000000045D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads