67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
Size 833KB
Sample260924-heedssty7q
SHA256 67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb
MD5 8223fd46a356426ad37ded23e8376bb7
SHA1 ca6d22ea173db037a4c6e2883eeb91380ad914ae
SHA512 e7ba0761af09d4726346c439b671473ca1f5057bac936f295d53a9a2b2e83f441e49a2e4c1bd028facadde4009280dccc138b2b32c8d9f6a0613ec5044567070
SSDEEP 24576:QWc7lYm7pK0riKiRIh6SSKjbwKUoOwiE4+/9+d1KV:QWc5Y3miSMSSK/fVj4+/9+dm
TLSH
T14405231AF3CC41F2D4D11B714CBA93719BB6FE7166B0435AA3604EBE1CB2941E948B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 defense_evasion discovery

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c623-19.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c628-58.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
1880	setup.exe
5840	pclock.exe

Loads dropped DLL 7 IoCs

pid	Process
1880	setup.exe
1880	setup.exe
1880	setup.exe
1880	setup.exe
1880	setup.exe
5840	pclock.exe
5840	pclock.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\VB5CHS.DLL	setup.exe
File opened for modification	C:\Windows\SysWOW64\timedate.dat	pclock.exe
File opened for modification	C:\Windows\SysWOW64\timedate.cpl	pclock.exe
File created	C:\Windows\SysWOW64\iedetect.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\iedetect.dll	setup.exe
File created	C:\Windows\SysWOW64\MSVBVM50.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\MSVBVM50.dll	setup.exe
File created	C:\Windows\SysWOW64\VB5CHS.DLL	setup.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\pclock\pc.htm	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File created	C:\Program Files (x86)\pclock\setup.exe	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\setup.exe	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File created	C:\Program Files (x86)\pclock\VB5CHS.DLL	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File created	C:\Program Files (x86)\pclock\MSVBVM50.dll	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File created	C:\Program Files (x86)\pclock\unxz.ini	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\unxz.ini	setup.exe
File opened for modification	C:\Program Files (x86)\pclock	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\MSVBVM50.dll	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\unxz.ini	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File created	C:\Program Files (x86)\pclock\hykey.dll	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File created	C:\Program Files (x86)\pclock\pclock.idt	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File created	C:\Program Files (x86)\pclock\pc.htm	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File created	C:\Program Files (x86)\pclock\pk.dll	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\pk.dll	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\hykey.dll	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\pclock.idt	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\vbszkit.td	setup.exe
File opened for modification	C:\Program Files (x86)\pclock\vbszkiu.td	setup.exe
File opened for modification	C:\Program Files (x86)\pclock\pclock.exe	setup.exe
File opened for modification	C:\Program Files (x86)\pclock\VB5CHS.DLL	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
File opened for modification	C:\Program Files (x86)\pclock\pclock.idt	setup.exe
File created	C:\Program Files (x86)\pclock\pclock.exe	setup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ipc.ini	pclock.exe
File created	C:\Windows\ipc.ini	pclock.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pclock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1304	ScreenClippingHost.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\International	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\International\nTimes = "66"	setup.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\TypeLib\ = "{C627D83F-3357-4250-B1A5-AA13E249983D}"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\MuiCache	ScreenClippingHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ = "_ShellExt"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\ = "pIContextMenu.ShellExt"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\InprocServer32\ = "C:\\Windows\\SysWow64\\iedetect.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ProxyStubClsid	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0\HELPDIR\ = "C:\\Windows\\system32"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Offline File\ = "{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0\HELPDIR	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ = "ShellExt"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Offline File	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\TypeLib\ = "{C627D83F-3357-4250-B1A5-AA13E249983D}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pIContextMenu.ShellExt\Clsid	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\Implemented Categories	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0\FLAGS\ = "0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\iedetect.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ = "_ShellExt"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\ProgID\ = "pIContextMenu.ShellExt"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0\ = "IContextMenu Shell Extension.."	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\VERSION\ = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pIContextMenu.ShellExt\ = "pIContextMenu.ShellExt"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\Programmable	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0\FLAGS	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0\0\win32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\TypeLib\ = "{C627D83F-3357-4250-B1A5-AA13E249983D}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{646F5C60-65CC-4B46-B994-CD4BE8BC4CF8}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}\VERSION	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pIContextMenu.ShellExt	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pIContextMenu.ShellExt\Clsid\ = "{3D3E83EA-EBB1-4C65-BF57-66B99DC334A1}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C627D83F-3357-4250-B1A5-AA13E249983D}\1.0\0	setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	ScreenClippingHost.exe
Token: SeDebugPrivilege	1304	ScreenClippingHost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4176	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
4176	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
1880	setup.exe
5840	pclock.exe
1304	ScreenClippingHost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 1880	4176	jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe	90
PID 1880 wrote to memory of 4304	1880	setup.exe	91
PID 1880 wrote to memory of 5364	1880	setup.exe	92
PID 1880 wrote to memory of 896	1880	setup.exe	93
PID 1880 wrote to memory of 5044	1880	setup.exe	94
PID 1880 wrote to memory of 2384	1880	setup.exe	95
PID 1880 wrote to memory of 5824	1880	setup.exe	96
PID 1880 wrote to memory of 3224	1880	setup.exe	97
PID 1880 wrote to memory of 888	1880	setup.exe	98
PID 1880 wrote to memory of 5652	1880	setup.exe	99
PID 1880 wrote to memory of 1764	1880	setup.exe	100
PID 1880 wrote to memory of 4764	1880	setup.exe	101
PID 1880 wrote to memory of 5840	1880	setup.exe	102

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_67f23df87052bc0d27627f320eb377863918b8f1583f3400f4c0210cd42976eb.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Program Files (x86)\pclock\setup.exe
  "C:\Program Files (x86)\pclock\setup.exe" pclock.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\mscomctl.ocx"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\tabctl32.ocx"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5364
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\mswinsck.ocx"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\comctl32.ocx"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5044
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\hyMenu.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2384
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\SkinVB.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5824
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\hytype.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3224
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\wbfc.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:888
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\MSADODC.OCX"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5652
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\pclock\MSDATGRD.OCX"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1764
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files\Common Files\Microsoft Shared\Speech\sapi.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4764
- - C:\Program Files (x86)\pclock\pclock.exe
    "C:\Program Files (x86)\pclock\pclock.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5840

C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppXvj4keqywbrw1mydqk4hd4832qv899sb2.mca
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msvbvm50.dll

Path C:\Program Files (x86)\pclock\msvbvm50.dll
Size 1.3MB
SHA256 5a6d432cde423fc9cfec65b775dfab18b6d1ccfd238c67ee4c68114f3a0c8523
MD5 6af16d3d7488152c543cecd7bfc7f46e
SHA1 8fcf96435600bfd2c023ed566be0b9d2ced959f4
SHA512 7ae37769a82f18891d09020a89dbdcffc9eca8f0670f5046b18e9fd8e22e9351882a043345704bebd7295d896bcb290ac88ba5b3fd4c7f5a4a0f644143e4d829
SSDEEP 24576:IwoTqcpXppLNzEM6vIJGwNx0SmAEOo82NgdqBV3oBSLLOi+eNU9MDk5:839ZP7x0SQnNjVoBSLLOi+iU99
TLSH
T125557C13B3D58072CBE658381B57773A76BC5C249A31A9477BE0392E29373411B2BB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pclock.idt

Path C:\Program Files (x86)\pclock\pclock.idt
Size 74KB
SHA256 17d892959fa771de94dbeaa69cbbf73032141768aff7151baf41d0e2fa223f13
MD5 fb4ee50e4fc5c677171c05da2d471e4c
SHA1 9ccdd0d544c9ee65919772be5b280bfe25a8db94
SHA512 eba78a90d2674d4969aef3c3d814c395d3d1b37202b238e9837c515f47ccdcb0f99a3b17a86b9b803ec7d9a5983b803f9a924bef0d1d04e227aaa47b09117f53
SSDEEP 1536:CfITuv/y3YVs4sXnJOagcXpQAdaazWZBDEqpQsJ+sfinDZjKIaB048NhaIsv1A3v:CKuH7XU8akAdzW3DTd+sADcIfjsdpHE1
TLSH
T1B87301109B4404A8E0C707B230ABD69715BBFD37549F895B92D12FAB3DB6F60D125B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\pclock\setup.exe
Size 35KB
SHA256 27f634bddd09a3407820ffb4a4e1dc45615a32e2d344e04824863d2aaa7b7c9c
MD5 91d94cea35d3c700973247fda59e5bd5
SHA1 3016b68c65dffd95b5387b5829c7cde911c5a24a
SHA512 22fe1e2baecf3ea472068be7ea94784c615626870b1fd68d2b2d81ba3070cba9f97a0f7d8a9a75516be85d8001087e53435edefcd05f2a3c36b7910a50f21034
SSDEEP 768:ulijILuSzk9a9BwkM/Bb659lvItIABiiBxBha5:ugjwz4a9i5/Ov0X
TLSH
T168F2E1CEA79895B8CC8F37B1102F6D43DD68E891B25280A5E6E59CAE7FA000959CDC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unxz.ini

Path C:\Program Files (x86)\pclock\unxz.ini
Size 18B
SHA256 0e1ee573d14e1e04986d69979ddda06b94685a766d2a3834664c64588b858546
MD5 00f2c3db18fc9a32e127e3703959ed94
SHA1 782dbbe00e6d56c495e38866687aad75ae0c138a
SHA512 487506173e87d0a3bf9c942832d118293afabd8f77ae9310cca97c2767af41ac2557c6f0350c2e0a82519d2f48aef3d5fc1bd824166a7bdeaabb305dd9d84b68
MD5 SHA1 SHA512

Submit Download

vb5chs.dll

Path C:\Program Files (x86)\pclock\vb5chs.dll
Size 80KB
SHA256 e6ffa50f8c18e4c4354d369e17b75d816d9ca17c135f176585d569c02266ce3a
MD5 3ea6bd7d06f29ab909bff9bfca0cf99a
SHA1 1767adc86dd8f7c6128c7e8176f375699b644ae7
SHA512 325d6236be6586c8bd0cef5c6e8dfcf07f9f08152aaa6303a8694af19390e8be62c24d3a5b43f4dbf47d8fdbc3a0a0192900c23d30727e3e65eabd865eccdc7a
SSDEEP 768:6AFAqeaiY1zjfnPzRu+lcH2tLrkQowyR+fxROm9j:64Aqeojtu+lnREI9
TLSH
T1B283A21A1BFD9904F4B3A7742F73C820ABABFA617A2BCF1D4860458D1D75E14AC0573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iedetect.dll

Path C:\Windows\SysWOW64\iedetect.dll
Size 19KB
SHA256 485ab7211434121779a22630527c37512e07d35ddb5e020adccc08647bd889a6
MD5 9a65fd1d745e8457decca3601df0e493
SHA1 3393f425674717b6f7901e87fdf47cb71adfaed0
SHA512 f5a34c97ddb58adf81005b3a0bd13ee381e1fccf57471c79172d9f4cc31831659e30130f7879dc30f5dbbf0ecbb53254171bf0ad82cab7323cf287e35b594cd0
SSDEEP 384:NlT/IxcuR9vwdo7XCglwZTN6y5ku9I9LKKlY7WwsW5DJWAEbrD5i:NlDyXSo7i6yb94UDJWAEbc
TLSH
T10992AF217FD0CA5AE8A54AF14EF6E5D6A6303CA40E22C45B72403B1F9CB3A04D571B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1880-30-0x00000000021B0000-0x00000000022FD000-memory.dmp

Download

memory/1880-50-0x0000000011000000-0x0000000011011000-memory.dmp

Download

memory/1880-52-0x0000000002030000-0x0000000002032000-memory.dmp

Download

memory/1880-24-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/1880-71-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4176-26-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/5840-64-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5840-73-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5840-78-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads