floxif | 44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/12/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
Size

671KB
MD5

09b9bb98de6b332dc3f24a3716e1e200
SHA1

42a2fff6f9128f4f455ca80b1b4fe5d98e42f36b
SHA256

44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995a
SHA512

eafe6bcec569097ab417d59286d9463faef6325a9de37e27fc1e5e0607af845f24588df80cb2d4cf70b76b9060924cebabef7fba0ff8ce843b60ed047c1129a2
SSDEEP

12288:Cm004ZpqVpP0uoODHYStSaO4/Yt0jYize5uPwsdODjGrn9BjvrEH7U:0IPbo//4/20MizOuPNOWrnTrEH7U

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000c0000000122e7-2.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c0000000122e7-2.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
1844	mint64.exe

Loads dropped DLL 6 IoCs

pid	Process
2644	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
2644	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
2076	REGSVR32.EXE
2120	REGSVR32.EXE
2248	REGSVR32.EXE
1396	REGSVR32.EXE

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\CmdRtr.DLL	mint64.exe
File created	C:\Windows\SysWOW64\CmdRtr.DLL	mint64.exe
File opened for modification	C:\Windows\SYSTEM32\APOMgr64.DLL	mint64.exe
File created	C:\Windows\SYSTEM32\APOMgr64.DLL	mint64.exe
File opened for modification	C:\Windows\SYSTEM32\CmdRtr64.DLL	mint64.exe
File created	C:\Windows\SYSTEM32\CmdRtr64.DLL	mint64.exe
File opened for modification	C:\Windows\SysWOW64\APOMngr.DLL	mint64.exe
File created	C:\Windows\SysWOW64\APOMngr.DLL	mint64.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000122e7-2.dat	upx
behavioral1/memory/2644-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2644-221-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ctfile.rfc	mint64.exe
File opened for modification	C:\Windows\ctfile.rfc	mint64.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REGSVR32.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REGSVR32.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration.1	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration\ = "APOManager Enumerator Class"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration.1\CLSID\ = "{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\TypeLib\ = "{F852C901-1A8C-4c74-A4CF-DDCBB12D6702}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration\ = "CommandRouter Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ = "CommandRouter Enumerator Class"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\ProgID	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32\ = "C:\\Windows\\SysWOW64\\APOMngr.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\APOMngr.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\ProgID\ = "APOManager.EndpointEnumeration.1"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\FLAGS\ = "0"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\VersionIndependentProgID	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\VersionIndependentProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration.1\CLSID\ = "{32CD1956-569B-432f-BA27-F0BFEA458D1B}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\VersionIndependentProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32\ = "C:\\Windows\\SYSTEM32\\APOMgr64.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration.1\ = "CommandRouter Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration.1\ = "APOManager Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\TypeLib\ = "{5F21BC6D-4756-44ff-BDF7-EF7C4B34F216}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\0\win64\ = "C:\\Windows\\SYSTEM32\\CmdRtr64.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration\CLSID\ = "{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\ = "APO Manager"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration.1\CLSID	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32\ = "C:\\Windows\\SysWOW64\\CmdRtr.DLL"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\ProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\0\win64\ = "C:\\Windows\\SYSTEM32\\APOMgr64.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\VersionIndependentProgID\ = "CommandRouter.EndpointEnumeration"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\VersionIndependentProgID\ = "APOManager.EndpointEnumeration"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\0	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\HELPDIR	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ = "CommandRouter Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\VersionIndependentProgID\ = "APOManager.EndpointEnumeration"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\0\win64	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\VersionIndependentProgID	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\CmdRtr.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration\ = "APOManager Enumerator Class"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ProgID	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration\CLSID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\ProgID\ = "APOManager.EndpointEnumeration.1"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration\CLSID\ = "{32CD1956-569B-432f-BA27-F0BFEA458D1B}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration.1\ = "APOManager Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32\ = "C:\\Windows\\SYSTEM32\\CmdRtr64.DLL"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\TypeLib	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\0	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\HELPDIR\ = "C:\\Windows\\SysWOW64"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration\CLSID\ = "{32CD1956-569B-432f-BA27-F0BFEA458D1B}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\FLAGS\ = "0"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\HELPDIR\ = "C:\\Windows\\SysWOW64"	REGSVR32.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2644	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
Token: SeLoadDriverPrivilege	1844	mint64.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1844	2644	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe	31
PID 2644 wrote to memory of 1844	2644	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe	31
PID 2644 wrote to memory of 1844	2644	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe	31
PID 2644 wrote to memory of 1844	2644	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe	31
PID 1844 wrote to memory of 2076	1844	mint64.exe	32
PID 1844 wrote to memory of 2076	1844	mint64.exe	32
PID 1844 wrote to memory of 2076	1844	mint64.exe	32
PID 1844 wrote to memory of 2076	1844	mint64.exe	32
PID 1844 wrote to memory of 2076	1844	mint64.exe	32
PID 1844 wrote to memory of 2076	1844	mint64.exe	32
PID 1844 wrote to memory of 2076	1844	mint64.exe	32
PID 1844 wrote to memory of 2120	1844	mint64.exe	33
PID 1844 wrote to memory of 2120	1844	mint64.exe	33
PID 1844 wrote to memory of 2120	1844	mint64.exe	33
PID 1844 wrote to memory of 2120	1844	mint64.exe	33
PID 1844 wrote to memory of 2120	1844	mint64.exe	33
PID 1844 wrote to memory of 2120	1844	mint64.exe	33
PID 1844 wrote to memory of 2120	1844	mint64.exe	33
PID 1844 wrote to memory of 2248	1844	mint64.exe	34
PID 1844 wrote to memory of 2248	1844	mint64.exe	34
PID 1844 wrote to memory of 2248	1844	mint64.exe	34
PID 1844 wrote to memory of 2248	1844	mint64.exe	34
PID 1844 wrote to memory of 2248	1844	mint64.exe	34
PID 1844 wrote to memory of 1396	1844	mint64.exe	35
PID 1844 wrote to memory of 1396	1844	mint64.exe	35
PID 1844 wrote to memory of 1396	1844	mint64.exe	35
PID 1844 wrote to memory of 1396	1844	mint64.exe	35
PID 1844 wrote to memory of 1396	1844	mint64.exe	35

C:\Users\Admin\AppData\Local\Temp\44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
"C:\Users\Admin\AppData\Local\Temp\44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\temp\CRF000\mint64.exe
  "C:\Windows\temp\CRF000\mint64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\REGSVR32.EXE
    C:\Windows\SysWOW64\REGSVR32.EXE /S APOMngr.DLL
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2076
- - C:\Windows\SysWOW64\REGSVR32.EXE
    C:\Windows\SysWOW64\REGSVR32.EXE /S CmdRtr.DLL
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2120
- - C:\Windows\SYSTEM32\REGSVR32.EXE
    C:\Windows\SYSTEM32\REGSVR32.EXE /S APOMgr64.DLL
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2248
- - C:\Windows\SYSTEM32\REGSVR32.EXE
    C:\Windows\SYSTEM32\REGSVR32.EXE /S CmdRtr64.DLL
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A1D26E2\DB0391CA54.tmp

Filesize
595KB

MD5
067393d41f77ddd66f95f1f216b2c708

SHA1
9c2e85dadf8ab2aa0a16448f1d267338fb375827

SHA256
eeda22bf24d1445e1960dd4d80657cbc5861abc342567905e955b9660e044400

SHA512
d64e248136b0756242dcb11c1e4b4beaba1cd43316530ae5553a8f635b958e6a111dcfd895f379b56a83b7627819bd953ded367213f7c7148811dbe5ebe3236d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDBA1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBC4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Temp\CRF000\creaf_ms.cab

Filesize
499KB

MD5
0b6c73cfdc72e47cbc8d53a2193dabf7

SHA1
7d4daabd634dbc7fadbe8750ac0f5a309af1b6be

SHA256
d1a019bb6517ad892dbf8483c71401b5f2cae3963a3430c8c0e24986342883f6

SHA512
e02e70ecb004075facfb5d11ab1dc93d95d4831341b9af1111d9a62a07452417a419f5aa959b2b4f80475266294f307497d426ce4c09dd65c8a113855c783302

Download Submit
C:\Windows\temp\CRF000\APOIM.ini

Filesize
9KB

MD5
74658b1bec847c67f9993225827fc83e

SHA1
ea8aea408884cd3f60c6f4ef88ee8708768637b4

SHA256
06ff5f1bda249eea6f8e84d34205800a5c817c4e481ffb60407770b74c8c9b16

SHA512
3fa8cef70211ce9444fd8f57487c4eb964dd959593f6850a47c8c124e92cf4bdd3629915a659072a9a6636c4f984aa7c56faa1260bac7c65762afed821dacbd7

Download Submit
C:\Windows\temp\CRF000\APOMgr64.DLL

Filesize
186KB

MD5
7c35c85de2ce3c74bb432301c53d7a87

SHA1
149d0a61629f93ce8aa8ca18fd337ff25ef25508

SHA256
55ec26c01213e51a246e192540483fe343e81d466224086cafef4b662d9bee85

SHA512
044baab1a9f76891467704f26303995075fccd5d9d5688f844cc46654c9aa2b93abeed83441061bc63cbb3b3c9ffbbbc9b845e1c2b673b0953a0ddd560c3a6bc

Download Submit
C:\Windows\temp\CRF000\APOMngr.DLL

Filesize
145KB

MD5
eeb2cef869a786ae94bf85340ba3168c

SHA1
257a6828db4aa755b1d526ffba34a5e5a1fcc97e

SHA256
88df120a60ca4882534e652c53d2742dd6f3ae93d71d18035aa080d2b3f5a4ea

SHA512
df4aa9159bfa72d8ffbaa6cf393843e4150e2753e0c12e63501e35af54d0407e57255326d4c4ad44674ca4fc908e9065f895e14f763cc9587228efd27838cc14

Download Submit
C:\Windows\temp\CRF000\CmdRtr.DLL

Filesize
72KB

MD5
45f681a6de7ccd2e2cc3bae71fc1cb51

SHA1
cc5048c6310a1f3bd1d4793c45605b31e88c3974

SHA256
d2957e66d1fc7252a9c715fe457e04cd0d4aa9ea0cc62d7c87f21c16a7cf372a

SHA512
3eac9267abd1ea3e3038d2ac8302b63c6761c90845728362a0ce5fb9b1b183f686c77ca0587c11b316783b9c5945365a921a15adeee7ca6d58be251cb6e04e9f

Download Submit
C:\Windows\temp\CRF000\CmdRtr64.DLL

Filesize
87KB

MD5
86f38bb08db7722d38f98eded13ee292

SHA1
c8c8ba335626a03209de6c7cc0f42e82834b31b7

SHA256
e8de437844a6beab521634069aa842e200d64026f1fb68d2305fc217b69fed6a

SHA512
40f5d10324333c6154ea7180bc16e1bf5abbf217fbda5076dc8d171b2754197290438ab71838eafe121728ce9b920f7737cb911bfe713997bb090f14e15be266

Download Submit
C:\Windows\temp\CRF000\mint.ini

Filesize
35B

MD5
f2f26bc7073a90038bbbbb77f857da63

SHA1
2535bc841a92c76ce679f95bea46fdb052355f4a

SHA256
e0cb99676289a6839134a420f73d16ab87e7fcc7eebdbe632b4c3fa6b76e25dc

SHA512
02dedebce961ec8013e8c40941ee83d366c6ef474ad1308f0fb8beb6c882de7e84769c49209183ddbee29a2461ff9bc4e8e6c37921aefe13768133891da323ad

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Windows\Temp\CRF000\mint64.exe

Filesize
278KB

MD5
4e347c53d17096950ca6e29de7c8b048

SHA1
c401d688f13553484c42981b2832d8e15a40ac99

SHA256
c7684779dd89a02ac48c331d03d74e7ee1e297921fb84c3583e52fc3aac654da

SHA512
dd3842774c0ace137ec3c657b6798a723078ca2a002180ec269fe7d12dc223705e0bdfdec95cad17c1273d25130a27eb20ca1004f719f12d77c7870dd41af56f

Download Submit
memory/2644-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2644-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2644-1-0x000000000040A000-0x000000000040B000-memory.dmp

Filesize
4KB

Download
memory/2644-221-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2644-222-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download