a637d7360ef409b2d9f3038de841583a039287ee7f54d2f634d9cea6c0fd502f

Reason

Machine shutdown

General

Target

chthonic_2.23.15.14.vir.exe
Size

407KB
MD5

878804a067f5d32ba006f57a6635e87e
SHA1

1433f4c575719b8a9269597a997e15ff2420caf5
SHA256

a637d7360ef409b2d9f3038de841583a039287ee7f54d2f634d9cea6c0fd502f
SHA512

707930f022dd4a0595f98c76e8602d8b531c1c7de8c0c311eef082b97fffab67358e7f633541c3afe00e9080d8017eba8e46c89392b5af7eb9e5f838b5f75961

Score

8^/10

persistence evasion trojan ransomware bootkit

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

540 LogonUI.exe
Disables taskbar notifications via registry modification
evasion

pid	process
540	LogonUI.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1063

Processes:

msiexec.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\antivirservice	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\antivirservice	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

chthonic_2.23.15.14.vir.exeAdobe_.exe

description	pid	process	target process
PID 1020 set thread context of 3820	1020	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1000 set thread context of 2900	1000	Adobe_.exe	Adobe_.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exemsiexec.exe

pid process

2564 msiexec.exe
2564 msiexec.exe
2980 msiexec.exe
2980 msiexec.exe

pid	process
2564	msiexec.exe
2564	msiexec.exe
2980	msiexec.exe
2980	msiexec.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

chthonic_2.23.15.14.vir.exechthonic_2.23.15.14.vir.exechthonic_2.23.15.14.vir.exemsiexec.execmd.exeAdobe_.exeAdobe_.exeAdobe_.exemsiexec.execmd.exe

description	pid	process	target process
PID 3612 wrote to memory of 1020	3612	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 3612 wrote to memory of 1020	3612	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 3612 wrote to memory of 1020	3612	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1020 wrote to memory of 3820	1020	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1020 wrote to memory of 3820	1020	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1020 wrote to memory of 3820	1020	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1020 wrote to memory of 3820	1020	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1020 wrote to memory of 3820	1020	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1020 wrote to memory of 3820	1020	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1020 wrote to memory of 3820	1020	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 3820 wrote to memory of 2564	3820	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 3820 wrote to memory of 2564	3820	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 3820 wrote to memory of 2564	3820	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 3820 wrote to memory of 2564	3820	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 2564 wrote to memory of 3760	2564	msiexec.exe	cmd.exe
PID 2564 wrote to memory of 3760	2564	msiexec.exe	cmd.exe
PID 2564 wrote to memory of 3760	2564	msiexec.exe	cmd.exe
PID 3760 wrote to memory of 3340	3760	cmd.exe	Adobe_.exe
PID 3760 wrote to memory of 3340	3760	cmd.exe	Adobe_.exe
PID 3760 wrote to memory of 3340	3760	cmd.exe	Adobe_.exe
PID 3340 wrote to memory of 1000	3340	Adobe_.exe	Adobe_.exe
PID 3340 wrote to memory of 1000	3340	Adobe_.exe	Adobe_.exe
PID 3340 wrote to memory of 1000	3340	Adobe_.exe	Adobe_.exe
PID 1000 wrote to memory of 2900	1000	Adobe_.exe	Adobe_.exe
PID 1000 wrote to memory of 2900	1000	Adobe_.exe	Adobe_.exe
PID 1000 wrote to memory of 2900	1000	Adobe_.exe	Adobe_.exe
PID 1000 wrote to memory of 2900	1000	Adobe_.exe	Adobe_.exe
PID 1000 wrote to memory of 2900	1000	Adobe_.exe	Adobe_.exe
PID 1000 wrote to memory of 2900	1000	Adobe_.exe	Adobe_.exe
PID 1000 wrote to memory of 2900	1000	Adobe_.exe	Adobe_.exe
PID 2900 wrote to memory of 2980	2900	Adobe_.exe	msiexec.exe
PID 2900 wrote to memory of 2980	2900	Adobe_.exe	msiexec.exe
PID 2900 wrote to memory of 2980	2900	Adobe_.exe	msiexec.exe
PID 2900 wrote to memory of 2980	2900	Adobe_.exe	msiexec.exe
PID 2980 wrote to memory of 2320	2980	msiexec.exe	cmd.exe
PID 2980 wrote to memory of 2320	2980	msiexec.exe	cmd.exe
PID 2980 wrote to memory of 2320	2980	msiexec.exe	cmd.exe
PID 2320 wrote to memory of 776	2320	cmd.exe	Adobe_.exe
PID 2320 wrote to memory of 776	2320	cmd.exe	Adobe_.exe
PID 2320 wrote to memory of 776	2320	cmd.exe	Adobe_.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe

Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
ransomware bootkit

Winlogon Helper DLL
T1004

Modify Registry
T1112

Processes:

LogonUI.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

msiexec.exe

description pid process

Token: SeShutdownPrivilege 2564 msiexec.exe
Executes dropped EXE 4 IoCs

Processes:

Adobe_.exeAdobe_.exeAdobe_.exeAdobe_.exe

pid process

3340 Adobe_.exe
1000 Adobe_.exe
2900 Adobe_.exe
776 Adobe_.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe

description	pid	process
Token: SeShutdownPrivilege	2564	msiexec.exe

pid	process
3340	Adobe_.exe
1000	Adobe_.exe
2900	Adobe_.exe
776	Adobe_.exe

Modifies service 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PolicyAgent	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PolicyAgent\Start = "4"	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\diagnosticshub.standardcollector.service	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\diagnosticshub.standardcollector.service\Start = "4"	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PcaSvc	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PcaSvc\Start = "4"	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WerSvc	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Start = "4"	msiexec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\software\microsoft\windows\currentversion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe_ = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe_\\Adobe_.exe"	msiexec.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

chthonic_2.23.15.14.vir.exemsiexec.exeAdobe_.exemsiexec.exe

pid process

3820 chthonic_2.23.15.14.vir.exe
2564 msiexec.exe
2900 Adobe_.exe
2980 msiexec.exe

pid	process
3820	chthonic_2.23.15.14.vir.exe
2564	msiexec.exe
2900	Adobe_.exe
2980	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe" -l
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1020

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe
C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
PID:3820

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
4⤵
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
- System policy modification
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Modifies service
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2564

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:3760

C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe
C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe
6⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3340

C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe
"C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe" -l
7⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1000

C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe
C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe
8⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2900

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
9⤵
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
PID:2980

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe"
10⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe
C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe
11⤵
- Executes dropped EXE
PID:776

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ac8855 /state1:0x41c64e6d
1⤵
- Suspicious use of SetWindowsHookEx
- Modifies data under HKEY_USERS
- Modifies WinLogon to allow AutoLogon
PID:540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

5

T1112

Credential Access

Discovery

Security Software Discovery

1

T1063

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe_\Adobe_.exe

Download Submit
memory/776-17-0x0000000000000000-mapping.dmp

Download
memory/1000-9-0x0000000000000000-mapping.dmp

Download
memory/1020-0-0x0000000000000000-mapping.dmp

Download
memory/2320-16-0x0000000000000000-mapping.dmp

Download
memory/2564-4-0x0000000000000000-mapping.dmp

Download
memory/2900-12-0x0000000000405FC3-mapping.dmp

Download
memory/2980-15-0x0000000000000000-mapping.dmp

Download
memory/3340-6-0x0000000000000000-mapping.dmp

Download
memory/3760-5-0x0000000000000000-mapping.dmp

Download
memory/3820-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3820-2-0x0000000000405FC3-mapping.dmp

Download
memory/3820-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads