2be5de601b37118386eee0bcb1bf3c91da0a44041f5dbd8a8d452a12e3777c07

Analysis

user interaction
yes
max time kernel
203s
max time network
181s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/10/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CPM2_Trainer_v1.0/CPM2_TrainerSetup.exe
Size 190KB
Sample261014-ar39pas13r
SHA256 2be5de601b37118386eee0bcb1bf3c91da0a44041f5dbd8a8d452a12e3777c07
MD5 2bd5506cd92af68fa06f72f03794856d
SHA1 0564921c738bdd1d9ae1aa9a1f72fb1ea3b99c72
SHA512 2b37e9889a7a83c16ccbcacd3bdb11441871b898106f2c3126e3215d27a814e4ef1534681a5e03073f314ca58ee08d551f434fc212eff019d5d9633fec42a6b9
SSDEEP 3072:ABuvKlEqQi7Wqa/AcxXC0YAqBm40WfnWpp1ugztxuLacpb7joRgz1sdJ:JiqAhAi01+Qt2acR
TLSH
T10914194D1BF49463CD243B3BB4A3AD364974A7D1782AF34D6CF611E645A2F82AC20763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation	CPM2_TrainerSetup.exe

Executes dropped EXE 1 IoCs

pid	Process
5032	CPM2_Trainer.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\CPM2_Trainer\cpm2_trainer.tmp	CPM2_TrainerSetup.exe
File created	C:\Program Files (x86)\CPM2_Trainer\docs\HOTKEYS.txt	CPM2_TrainerSetup.exe
File opened for modification	C:\Program Files (x86)\CPM2_Trainer\profiles\profiles.json	CPM2_TrainerSetup.exe
File created	C:\Program Files (x86)\CPM2_Trainer\CPM2_Trainer.exe	CPM2_TrainerSetup.exe
File opened for modification	C:\Program Files (x86)\CPM2_Trainer\readme.txt	CPM2_TrainerSetup.exe
File opened for modification	C:\Program Files (x86)\CPM2_Trainer\docs\HOTKEYS.txt	CPM2_TrainerSetup.exe
File created	C:\Program Files (x86)\CPM2_Trainer\profiles\profiles.json	CPM2_TrainerSetup.exe
File created	C:\Program Files (x86)\CPM2_Trainer\changelog.txt	CPM2_TrainerSetup.exe
File opened for modification	C:\Program Files (x86)\CPM2_Trainer\changelog.txt	CPM2_TrainerSetup.exe
File opened for modification	C:\Program Files (x86)\CPM2_Trainer\CPM2_Trainer.exe	CPM2_TrainerSetup.exe
File created	C:\Program Files (x86)\CPM2_Trainer\readme.txt	CPM2_TrainerSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CPM2_TrainerSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CPM2_TrainerSetup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CPM2_TrainerSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	CPM2_Trainer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	CPM2_Trainer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	CPM2_Trainer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	CPM2_Trainer.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 98003100000000004e5d9303110050524f4752417e320000800009000400efbe874fdb494e5d97032e000000e1000000000001000000000000000000560000000000cae5a700500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).right = "1596"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).bottom = "1250"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1920x1080x96(1).y = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f80cb859f6720028040b29b5540cc05aab60000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).left = "457"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 62003100000000004e5d9303100043504d325f547e3100004a0009000400efbe4e5d93034e5d97032e000000fc830200000007000000000000000000000000000000cae5a700430050004d0032005f0054007200610069006e0065007200000018000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).x = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1848	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5032	CPM2_Trainer.exe
5032	CPM2_Trainer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1848	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	CPM2_TrainerSetup.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1848	explorer.exe
3636	CPM2_TrainerSetup.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe
1848	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 2832	3636	CPM2_TrainerSetup.exe	90
PID 3636 wrote to memory of 5032	3636	CPM2_TrainerSetup.exe	92
PID 1848 wrote to memory of 1852	1848	explorer.exe	96

C:\Users\Admin\AppData\Local\Temp\CPM2_Trainer_v1.0\CPM2_TrainerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\CPM2_Trainer_v1.0\CPM2_TrainerSetup.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Program Files (x86)\CPM2_Trainer
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Program Files (x86)\CPM2_Trainer\CPM2_Trainer.exe
  "C:\Program Files (x86)\CPM2_Trainer\CPM2_Trainer.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5032

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\CPM2_Trainer\readme.txt
  2⤵
  PID:1852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CPM2_Trainer.exe

Path C:\Program Files (x86)\CPM2_Trainer\CPM2_Trainer.exe
Size 16.4MB
SHA256 fd120d9a99b0267f8683c84c8382d28cef6fc997021a1223e85f1255e5d0e92f
MD5 08ff7c0a734ed8eacf6915bfd902cec7
SHA1 f78e6a2e0ef8519ef283305d6827dc3d5247da4c
SHA512 f2f6b803593acb3ea78c8cfcb6c4bb15457868b61e0211cdabdce2da2ec7ce8226f6b451f983317e277f48dab6194b87946b9426edec7aef159e48b46e4e5f31
SSDEEP 393216:cCAqSeQW7C5glHSB6/1jQgIbhinRDpS0wCdP:cCAqSextd/2Xhin0CdP
TLSH
T1240723C2AEE992D4C8934E00638B17DE61D1B29F85FA592E3ACF4C037530D97854AE77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Program Files (x86)\CPM2_Trainer\readme.txt
Size 3KB
SHA256 1335b6e38ab9fe7ec84e21493ddcb25389628ebc297abc008763181289550423
MD5 70e6d106be3d17c247c294732d118629
SHA1 c8a5d6a98b3ef4584f384a9ff8ec3a1efd03b5c0
SHA512 3f3267f030a864eca0baa3dbfafd0e1ab4515b96c48f79120641a3bb537a17ff614ce4d894b1d7ea4194b32181a5b198c811722daafda919f5f818fc3504b627
TLSH
T1C561BD3F535A325A3B3B151F5A113202F4233152A36665673CE5B028DC3DF0EEBA0349
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-61-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-64-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-69-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-68-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-66-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-67-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-63-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-58-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-65-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-62-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-60-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-59-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-57-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-54-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-56-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/1848-55-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/3636-11-0x00000000149C0000-0x00000000149D2000-memory.dmp

Download

memory/3636-8-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3636-4-0x0000000005110000-0x000000000511A000-memory.dmp

Download

memory/3636-5-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3636-6-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3636-35-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3636-0-0x0000000000720000-0x0000000000754000-memory.dmp

Download

memory/3636-2-0x0000000005180000-0x0000000005212000-memory.dmp

Download

memory/3636-1-0x0000000005690000-0x0000000005C36000-memory.dmp

Download

memory/3636-10-0x000000000A860000-0x000000000A86A000-memory.dmp

Download

memory/3636-3-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3636-7-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/5032-40-0x00007FFC6C930000-0x00007FFC6C932000-memory.dmp

Download

memory/5032-41-0x0000000140000000-0x0000000141A80000-memory.dmp

Download

memory/5032-45-0x0000000140000000-0x0000000141A80000-memory.dmp

Download