797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468

General

Target
797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Size 920KB
Sample260801-eyr78ade98
SHA256 797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468
MD5 55f88031582b5b2f5d0a69bcd6c9f8a4
SHA1 77571d278e7e65baa224ddca089f0adcbb8a5e5e
SHA512 1edae9274609d2813bab4fe585b59ce209114bbedeee4121274d1c463c816ecc06942d9111d90dc4e0d1160627c4579337a1ccb6d1179ac015fc30b5cc1352ab
SSDEEP 24576:uyWZ8IpsDk6+pZSl8/vqBSqKiOOMdCz/oQ43Fh9:t6tLpZABSqK+yjzVh9
TLSH
T1741523A0E794C85FE1F3997513370323E975E16E05A02B1787812A497FAB1C3A63E7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 2 IoCs

pid	Process
5596	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
5596	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Snipkap\Snipkap.exe	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
File created	C:\Program Files\Snipkap\Uninstall.exe	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\AllFilesystemObjects\shell\Snipkap.Pin\DropTarget	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A6D8E55C-6F6D-4B0D-9DB5-2B5B458C8E7A}\LocalServer32	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6D8E55C-6F6D-4B0D-9DB5-2B5B458C8E7A}\LocalServer32\ = "\"C:\\Program Files\\Snipkap\\Snipkap.exe\" --shell-drop-target"	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\Snipkap.Pin\MultiSelectModel = "Player"	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\Snipkap.Pin\Position = "Top"	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\Snipkap.Pin\DropTarget\CLSID = "{A6D8E55C-6F6D-4B0D-9DB5-2B5B458C8E7A}"	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A6D8E55C-6F6D-4B0D-9DB5-2B5B458C8E7A}	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6D8E55C-6F6D-4B0D-9DB5-2B5B458C8E7A}\ = "Snipkap Shell Pin Drop Target"	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6D8E55C-6F6D-4B0D-9DB5-2B5B458C8E7A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Snipkap\\Snipkap.exe"	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AllFilesystemObjects\shell\Snipkap.Pin	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\Snipkap.Pin\MUIVerb = "使用 Snipkap 贴图"	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\Snipkap.Pin\Icon = "\"C:\\Program Files\\Snipkap\\Snipkap.exe\",0"	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\Snipkap.Pin\NeverDefault	797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe

C:\Users\Admin\AppData\Local\Temp\797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe
"C:\Users\Admin\AppData\Local\Temp\797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Snipkap.exe

Path C:\Program Files\Snipkap\Snipkap.exe
Size 1.3MB
SHA256 df074c77699353812981935e511a4f220ac80129d6a3102dc33c1d9e067001c8
MD5 974801403ed5c535e34aeeb64971cbb4
SHA1 7df488296bbd421a1628e39eeaba9dd5036725f9
SHA512 374ab9d2feaa0dabb06d85c149cdebdef209d26357730a8046a8dffbaa9418148aba5429121fa4cf18de726db10ecd801a70ec289c69d300d99f0f99c63a9f43
SSDEEP 24576:Wbl3k2A2QZlkqVkX2NhUUSDUeGCKkjVkno17dv/Yd+MkFeVTq:H2yfkkkmvLSD/GCKkjVkuQzTq
TLSH
T12665CF3773A015F9E5B7C2B68C775602EA7A78093214D4EBD7F840A32F264A7213B725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq698F.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsq698F.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq698F.tmp\nsDialogs.dll
Size 9KB
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads