Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe
-
Size
320KB
-
MD5
793d498a7c52db86001906f199900cbd
-
SHA1
3094e39497ce398648a532ac8f38557c9b77df0e
-
SHA256
9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db
-
SHA512
b646e8d0b1c1c3fd494f9da5269950955f5ee1aad3382f68e9ff591746ca2a2bb6966f8584aeee5dc9bfadc766fbafd0180ee595125edd1e836c3221caa03c60
-
SSDEEP
6144:vTwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:rXgvmzFHi0mo5aH0qMzd5807FRPJQPDV
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xbgns.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xbgns.exe -
Adds policy Run key to start application 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxjxjzivhpig = "vngburhbujjoqjcaguz.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxjxjzivhpig = "ibvrljavpfgmpjdcjyex.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjsdmzfpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibvrljavpfgmpjdcjyex.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxjxjzivhpig = "vngburhbujjoqjcaguz.exe" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjsdmzfpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjsdmzfpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxjxjzivhpig = "ujzrhbofvhegfvlg.exe" xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxjxjzivhpig = "xrmjedvrmdfmqlggoelfa.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxjxjzivhpig = "ibvrljavpfgmpjdcjyex.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjsdmzfpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxjxjzivhpig = "vngburhbujjoqjcaguz.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjsdmzfpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxjxjzivhpig = "xrmjedvrmdfmqlggoelfa.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjsdmzfpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe" xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xbgns.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xbgns.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xbgns.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xbgns.exe -
Executes dropped EXE 2 IoCs
pid Process 1580 xbgns.exe 1680 xbgns.exe -
Loads dropped DLL 4 IoCs
pid Process 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ujzrhbofvhegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdsjyrdtitpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bribsnbtkxvyypgcg.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mzndrjujxhcczn = "vngburhbujjoqjcaguz.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibvrljavpfgmpjdcjyex.exe" xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngburhbujjoqjcaguz.exe ." xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mzndrjujxhcczn = "ujzrhbofvhegfvlg.exe ." xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ujzrhbofvhegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe" xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bribsnbtkxvyypgcg.exe ." xbgns.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "kbtnfbqjbpostldafs.exe" xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mzndrjujxhcczn = "ibvrljavpfgmpjdcjyex.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe ." 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lxkzmdnboxrqm = "bribsnbtkxvyypgcg.exe" xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe" xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe ." xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ujzrhbofvhegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmjedvrmdfmqlggoelfa.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdsjyrdtitpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe ." xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "vngburhbujjoqjcaguz.exe ." xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "ibvrljavpfgmpjdcjyex.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mzndrjujxhcczn = "vngburhbujjoqjcaguz.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lxkzmdnboxrqm = "kbtnfbqjbpostldafs.exe" xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bribsnbtkxvyypgcg.exe ." xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ujzrhbofvhegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "xrmjedvrmdfmqlggoelfa.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "bribsnbtkxvyypgcg.exe ." xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "vngburhbujjoqjcaguz.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmjedvrmdfmqlggoelfa.exe ." xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "xrmjedvrmdfmqlggoelfa.exe ." 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ujzrhbofvhegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibvrljavpfgmpjdcjyex.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdsjyrdtitpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngburhbujjoqjcaguz.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lxkzmdnboxrqm = "xrmjedvrmdfmqlggoelfa.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "bribsnbtkxvyypgcg.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdsjyrdtitpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmjedvrmdfmqlggoelfa.exe ." xbgns.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ujzrhbofvhegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmjedvrmdfmqlggoelfa.exe" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "vngburhbujjoqjcaguz.exe" xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mzndrjujxhcczn = "ibvrljavpfgmpjdcjyex.exe ." xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdsjyrdtitpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibvrljavpfgmpjdcjyex.exe ." xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mzndrjujxhcczn = "kbtnfbqjbpostldafs.exe ." 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "ibvrljavpfgmpjdcjyex.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "xrmjedvrmdfmqlggoelfa.exe" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mzndrjujxhcczn = "bribsnbtkxvyypgcg.exe ." xbgns.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run xbgns.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "kbtnfbqjbpostldafs.exe ." xbgns.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdsjyrdtitpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbtnfbqjbpostldafs.exe ." 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "bribsnbtkxvyypgcg.exe ." xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lxkzmdnboxrqm = "kbtnfbqjbpostldafs.exe" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibvrljavpfgmpjdcjyex.exe" xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\udnzjxepzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe" xbgns.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lxkzmdnboxrqm = "vngburhbujjoqjcaguz.exe" xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdsjyrdtitpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ujzrhbofvhegfvlg.exe ." xbgns.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pzkxixfrcjb = "ujzrhbofvhegfvlg.exe ." xbgns.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xbgns.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xbgns.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 www.showmyipaddress.com 6 whatismyip.everdot.org 9 whatismyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\yxxzzdabbxeqzzzermyxxz.dab xbgns.exe File created C:\Windows\SysWOW64\yxxzzdabbxeqzzzermyxxz.dab xbgns.exe File opened for modification C:\Windows\SysWOW64\pzkxixfrcjbysdoecifpanynvhszroite.syv xbgns.exe File created C:\Windows\SysWOW64\pzkxixfrcjbysdoecifpanynvhszroite.syv xbgns.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\pzkxixfrcjbysdoecifpanynvhszroite.syv xbgns.exe File created C:\Program Files (x86)\pzkxixfrcjbysdoecifpanynvhszroite.syv xbgns.exe File opened for modification C:\Program Files (x86)\yxxzzdabbxeqzzzermyxxz.dab xbgns.exe File created C:\Program Files (x86)\yxxzzdabbxeqzzzermyxxz.dab xbgns.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\yxxzzdabbxeqzzzermyxxz.dab xbgns.exe File created C:\Windows\yxxzzdabbxeqzzzermyxxz.dab xbgns.exe File opened for modification C:\Windows\pzkxixfrcjbysdoecifpanynvhszroite.syv xbgns.exe File created C:\Windows\pzkxixfrcjbysdoecifpanynvhszroite.syv xbgns.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1580 xbgns.exe 1580 xbgns.exe 1580 xbgns.exe 1580 xbgns.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1580 xbgns.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1580 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 28 PID 1948 wrote to memory of 1580 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 28 PID 1948 wrote to memory of 1580 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 28 PID 1948 wrote to memory of 1580 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 28 PID 1948 wrote to memory of 1680 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 29 PID 1948 wrote to memory of 1680 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 29 PID 1948 wrote to memory of 1680 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 29 PID 1948 wrote to memory of 1680 1948 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe 29 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xbgns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xbgns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xbgns.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe"C:\Users\Admin\AppData\Local\Temp\9b14c658ca65e6dbb15909058b378e7fec8926283309c59804117f34d48244db.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\xbgns.exe"C:\Users\Admin\AppData\Local\Temp\xbgns.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\xbgns.exe"C:\Users\Admin\AppData\Local\Temp\xbgns.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:1680
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
716KB
MD534dbca41b01fc6b44faa6cad08acf46e
SHA156dd82e7cfae664f24814479eece8b5975ed7910
SHA256188df2f40d12ea7c34f1b17be80a2bd5004d5918eb7dce7ef559d918303d5f9e
SHA512701711e4535fa483580b07c71da3acbafe292a950b462ac928847523431a8519c18db8adc671dd354f2cb53084fddb23ee489ed87abcc1acf2f3fd15fded0d8e
-
Filesize
716KB
MD534dbca41b01fc6b44faa6cad08acf46e
SHA156dd82e7cfae664f24814479eece8b5975ed7910
SHA256188df2f40d12ea7c34f1b17be80a2bd5004d5918eb7dce7ef559d918303d5f9e
SHA512701711e4535fa483580b07c71da3acbafe292a950b462ac928847523431a8519c18db8adc671dd354f2cb53084fddb23ee489ed87abcc1acf2f3fd15fded0d8e
-
Filesize
716KB
MD534dbca41b01fc6b44faa6cad08acf46e
SHA156dd82e7cfae664f24814479eece8b5975ed7910
SHA256188df2f40d12ea7c34f1b17be80a2bd5004d5918eb7dce7ef559d918303d5f9e
SHA512701711e4535fa483580b07c71da3acbafe292a950b462ac928847523431a8519c18db8adc671dd354f2cb53084fddb23ee489ed87abcc1acf2f3fd15fded0d8e
-
Filesize
716KB
MD534dbca41b01fc6b44faa6cad08acf46e
SHA156dd82e7cfae664f24814479eece8b5975ed7910
SHA256188df2f40d12ea7c34f1b17be80a2bd5004d5918eb7dce7ef559d918303d5f9e
SHA512701711e4535fa483580b07c71da3acbafe292a950b462ac928847523431a8519c18db8adc671dd354f2cb53084fddb23ee489ed87abcc1acf2f3fd15fded0d8e
-
Filesize
716KB
MD534dbca41b01fc6b44faa6cad08acf46e
SHA156dd82e7cfae664f24814479eece8b5975ed7910
SHA256188df2f40d12ea7c34f1b17be80a2bd5004d5918eb7dce7ef559d918303d5f9e
SHA512701711e4535fa483580b07c71da3acbafe292a950b462ac928847523431a8519c18db8adc671dd354f2cb53084fddb23ee489ed87abcc1acf2f3fd15fded0d8e
-
Filesize
716KB
MD534dbca41b01fc6b44faa6cad08acf46e
SHA156dd82e7cfae664f24814479eece8b5975ed7910
SHA256188df2f40d12ea7c34f1b17be80a2bd5004d5918eb7dce7ef559d918303d5f9e
SHA512701711e4535fa483580b07c71da3acbafe292a950b462ac928847523431a8519c18db8adc671dd354f2cb53084fddb23ee489ed87abcc1acf2f3fd15fded0d8e