1a25fd1d082e7958e4224626252b6c98f97db80c072cbce09e49ca2f30f410f1

General

Target
UpdateOrderingClients2023.exe
Size 131KB
Sample260629-w15prsdw7j
SHA256 1a25fd1d082e7958e4224626252b6c98f97db80c072cbce09e49ca2f30f410f1
MD5 c46a9ec37e3ec40027acd75b83657dc8
SHA1 9112770b1abaa6101c933d5561ffe0d5b482a5e7
SHA512 bc70232b6db523aab2bf257130fef32cf1df949ab757b65bfd8180992281a435a294795e5f0f5e60485849c41fb7f8aa6be1337b9738546bcc5383d656cce724
SSDEEP 1536:mgzTq6SO0U48THFiYfngn6erbn6erdiwVcl:CUREYgiqY
TLSH
T104D3C500E3B4662CF5B597342AB0B562CEF1E5876613EA0CFDFE70985F6270586406BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	UpdateOrderingClients2023.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	UpdateOrderingClients2023.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 9800310000000000ad5cf3a9110050524f4752417e320000800009000400efbe874fdb49ad5cf3a92e000000c304000000000100000000000000000056000000000077c18e00500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	UpdateOrderingClients2023.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	UpdateOrderingClients2023.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	UpdateOrderingClients2023.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	UpdateOrderingClients2023.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe
2920	UpdateOrderingClients2023.exe

C:\Users\Admin\AppData\Local\Temp\UpdateOrderingClients2023.exe
"C:\Users\Admin\AppData\Local\Temp\UpdateOrderingClients2023.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2920-0-0x0000029F03FC0000-0x0000029F03FE6000-memory.dmp

Download

memory/2920-1-0x0000029F043D0000-0x0000029F043E0000-memory.dmp

Download

memory/2920-2-0x0000029F043D0000-0x0000029F043E0000-memory.dmp

Download

memory/2920-3-0x0000029F043D0000-0x0000029F043E0000-memory.dmp

Download

memory/2920-4-0x0000029F043D0000-0x0000029F043E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads