Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 19:17
Static task
static1
Behavioral task
behavioral1
Sample
1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe
Resource
win10v2004-20241007-en
General
-
Target
1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe
-
Size
124KB
-
MD5
0d44e21cc26806ba9cefb553fd25327e
-
SHA1
4039bc7941bce053c73d41df50a8267eaeded1f9
-
SHA256
1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227
-
SHA512
170c1d68c59dbf7b8d4eaeab14f15a4d5e2611f0f34408f9828ed96ce1ff5a34972d3cba1a11d1a4f9fc62a3089ec17b5bd07df98eced11a8a8135cdc8278e4c
-
SSDEEP
1536:s1qcQMheJwmbKSyVfwT5xvOt0rPQ4llm6JMBtD4iJu/KS7b9qrFaiAOa0kHNPVe2:e9hYUMI44Vu/fv9YpnUpVky
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:\users\admin\appdata\local\temp\1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe = "c:\\users\\admin\\appdata\\local\\temp\\1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe:*:Enabled:SMPN" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wdfmgr = "c:\\windows\\wdfmgr.exe" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msrpc = "c:\\windows\\msrpc.exe" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wdfmgr\ImagePath = "c:\\windows\\wdfmgr.exe" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdfmgr = "c:\\windows\\wdfmgr.exe" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\wdfmgr = "c:\\windows\\wdfmgr.exe" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsassv = "c:\\windows\\lsassv.exe" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\x: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\v: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\s: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\o: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\n: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\m: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\z: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\l: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\j: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\h: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\e: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\w: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\u: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\t: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\r: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\p: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\g: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\y: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\q: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened (read-only) \??\i: 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\regedit.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created \??\c:\windows\wdfmgr.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File created \??\c:\windows\msrpc.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened for modification \??\c:\windows\calc.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened for modification \??\c:\windows\wdfmgr.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened for modification \??\c:\windows\regedit2.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File created \??\c:\windows\Start Menu\Programs\Startup\AdobeLoader.scr 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened for modification \??\c:\windows\mui\rctfd.sys 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File created \??\c:\windows\lsassv.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened for modification \??\c:\windows\lsassv.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened for modification \??\c:\windows\msrpc.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File created \??\c:\windows\regedit2.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File created \??\c:\windows\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\AdobeLoader.scr 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File opened for modification \??\c:\windows\mui\olefx.dll 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe File created \??\c:\windows\calc.exe 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\Dism\\ja-JP\\SmiProvider.dll.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Manifests\\amd64_mdmcxpv6.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_72f3d4cf9d3dccb6.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Manifests\\amd64_microsoft-windows-c..tasp1.res.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6d6425db9d79ae22.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "1048" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "104063" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "29068" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\DriverStore\\FileRepository\\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\\Amd64\\HPZIPR12.DLL" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "74525" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "111203" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Manifests\\amd64_microsoft-windows-p..peeradmin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_719df0580731deba.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Program Files (x86)\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "36371" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Manifests\\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_it-it_04f87c1305f0d058.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Program Files (x86)\\Common Files\\System\\msadc\\ja-JP\\msdaremr.dll.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "34152" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "103851" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "106258" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Manifests\\amd64_microsoft-windows-t..inkwatson.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f734ab4b52e9d642.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "26545" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\DriverStore\\FileRepository\\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\\Amd64\\smf6x5u.xml" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Manifests\\amd64_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7601.17514_none_97c2246fee970dbb.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\gpedit.dll" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\en-US\\powershell_ise.resources.dll" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_prnep003.inf_31bf3856ad364e35_6.1.7600.16385_none_9403111e2c10328e\\prnep003.inf" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "98522" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\DriverStore\\de-DE\\arcsas.inf_loc" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\en-US\\msaatext.dll.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "49739" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_ru-ru_29e175fbc10a89d0\\DWrite.dll.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\DriverStore\\FileRepository\\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\\Amd64\\BRD131C.GPD" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "71746" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "77349" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\BitLockerDiscoveryVolumeContents\\de-DE_BitLockerToGo.exe.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "16520" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "31915" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "66209" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_sti.inf_31bf3856ad364e35_6.1.7600.16385_none_b5d3c30ffa77a77a\\scsiscan.sys" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "103376" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\schemas\\EAPHost\\eapuserpropertiesv1.xsd" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWOW64\\it-IT\\loadperf.dll.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "11622" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "30427" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "37963" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "75332" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "91035" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "107718" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "114565" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Program Files\\Java\\jdk1.7.0_80\\lib\\missioncontrol\\features\\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\\META-INF\\ECLIPSE_.RSA" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\DriverStore\\FileRepository\\prnhp003.inf_amd64_neutral_4480210763997eb4\\Amd64\\hpd7200t.gpd" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "66817" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "95072" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_6.1.7601.17514_it-it_1ee6b4808fedf0f8\\msdasqlr.dll.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-onlineidcpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_808b0be0dbba7418\\OnLineIDCPL.dll.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Backup\\wow64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_66e40021f6ac2d53.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Program Files (x86)\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\mtxlegih.dll" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\amd64_microsoft-windows-m..nager-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bd23d596d204e54\\odbcint.dll.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "95944" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Manifests\\amd64_brmfcmf.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8910876519478872.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "23518" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "32918" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\SysWow64\\it-IT\\runonce.exe.mui" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FNum = "78183" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\FLast = "c:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636.manifest" 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe"C:\Users\Admin\AppData\Local\Temp\1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe"1⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2676
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
4Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD59e4fc5458e8c6538130bfdf13f46ce45
SHA1a3bb4a1598f2162a88351f5f78a49660e54b9c52
SHA256612b3f592a79e685c5699ea5e0f75514d1e15bb576f4633150dd21d9da560a0e
SHA51236e4688c89ce4126de2effbccd52e760c8380d443c09ad0258627f599964d813dcdab0b58ce841d5189ba128e1fa39167ba8204f90143fd18b9b418062908f1d