sality | 64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Size

400KB
MD5

701866df405b186ee9cd163328f8cd10
SHA1

f5eef955245e0b5a497e09c17eeb160742530875
SHA256

64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79
SHA512

a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17
SSDEEP

6144:kHbbELf/MR/cWdi5pV/JNWOVhMW668UXreVX7IcJIch:AdOpNX1hp8U78JIch

Score

10^/10

sality backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Modifies visibility of file extensions in Explorer 2 TTPs 13 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinAlert.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinAlert.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinAlert.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Commgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinAlert.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Commgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Commgr.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 13 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Commgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinAlert.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinAlert.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Commgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinAlert.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Commgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinSysApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WinAlert.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Executes dropped EXE 12 IoCs

pid	Process
3296	WinAlert.exe
3224	Commgr.exe
2456	WinSysApp.exe
4248	WinAlert.exe
2164	Commgr.exe
3032	Commgr.exe
3932	WinSysApp.exe
4536	WinAlert.exe
1140	WinSysApp.exe
1936	WinSysApp.exe
2400	WinAlert.exe
3028	WinSysApp.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3856-133-0x00000000023E0000-0x000000000346E000-memory.dmp	upx
behavioral2/memory/3856-178-0x00000000023E0000-0x000000000346E000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Commgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WinAlert.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinAlert.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinAlert.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinAlert.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	Commgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinAlert.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinSysApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	WinAlert.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe"	WinAlert.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	Commgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe"	Commgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe"	WinSysApp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\W:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\E:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\G:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\I:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\J:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\K:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\P:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\N:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\O:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\Q:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\S:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\U:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\V:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\H:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\M:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\Y:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\Z:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\F:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\L:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\R:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened (read-only)	\??\X:	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Commgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WinAlert.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
Token: SeDebugPrivilege	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 768	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	1
PID 3856 wrote to memory of 772	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	13
PID 3856 wrote to memory of 1004	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	10
PID 3856 wrote to memory of 2360	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	61
PID 3856 wrote to memory of 2376	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	60
PID 3856 wrote to memory of 2476	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	59
PID 3856 wrote to memory of 3020	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	50
PID 3856 wrote to memory of 2420	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	49
PID 3856 wrote to memory of 3244	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	24
PID 3856 wrote to memory of 3344	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	48
PID 3856 wrote to memory of 3408	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	47
PID 3856 wrote to memory of 3488	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	46
PID 3856 wrote to memory of 3832	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	45
PID 3856 wrote to memory of 4764	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	42
PID 3856 wrote to memory of 4452	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	28
PID 3856 wrote to memory of 3224	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	84
PID 3856 wrote to memory of 3224	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	84
PID 3856 wrote to memory of 3224	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	84
PID 3856 wrote to memory of 3296	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	85
PID 3856 wrote to memory of 3296	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	85
PID 3856 wrote to memory of 3296	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	85
PID 3856 wrote to memory of 4248	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	87
PID 3856 wrote to memory of 4248	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	87
PID 3856 wrote to memory of 4248	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	87
PID 3856 wrote to memory of 2456	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	86
PID 3856 wrote to memory of 2456	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	86
PID 3856 wrote to memory of 2456	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	86
PID 3856 wrote to memory of 3032	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	88
PID 3856 wrote to memory of 3032	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	88
PID 3856 wrote to memory of 3032	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	88
PID 3856 wrote to memory of 2164	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	89
PID 3856 wrote to memory of 2164	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	89
PID 3856 wrote to memory of 2164	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	89
PID 3856 wrote to memory of 3932	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	91
PID 3856 wrote to memory of 3932	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	91
PID 3856 wrote to memory of 3932	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	91
PID 3856 wrote to memory of 4536	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	92
PID 3856 wrote to memory of 4536	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	92
PID 3856 wrote to memory of 4536	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	92
PID 3856 wrote to memory of 1140	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	93
PID 3856 wrote to memory of 1140	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	93
PID 3856 wrote to memory of 1140	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	93
PID 3224 wrote to memory of 1936	3224	Commgr.exe	94
PID 3224 wrote to memory of 1936	3224	Commgr.exe	94
PID 3224 wrote to memory of 1936	3224	Commgr.exe	94
PID 3224 wrote to memory of 2400	3224	Commgr.exe	95
PID 3224 wrote to memory of 2400	3224	Commgr.exe	95
PID 3224 wrote to memory of 2400	3224	Commgr.exe	95
PID 4248 wrote to memory of 3028	4248	WinAlert.exe	96
PID 4248 wrote to memory of 3028	4248	WinAlert.exe	96
PID 4248 wrote to memory of 3028	4248	WinAlert.exe	96
PID 3856 wrote to memory of 768	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	1
PID 3856 wrote to memory of 772	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	13
PID 3856 wrote to memory of 1004	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	10
PID 3856 wrote to memory of 2360	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	61
PID 3856 wrote to memory of 2376	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	60
PID 3856 wrote to memory of 2476	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	59
PID 3856 wrote to memory of 3020	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	50
PID 3856 wrote to memory of 2420	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	49
PID 3856 wrote to memory of 3244	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	24
PID 3856 wrote to memory of 3344	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	48
PID 3856 wrote to memory of 3408	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	47
PID 3856 wrote to memory of 3488	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	46
PID 3856 wrote to memory of 3832	3856	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe	45

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1004

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3244

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4764

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3832

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3408

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3020
- C:\Users\Admin\AppData\Local\Temp\64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe
  "C:\Users\Admin\AppData\Local\Temp\64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Windows security bypass
  - Checks computer location settings
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3856
- - C:\Program Files\Windows Common Files\Commgr.exe
    "C:\Program Files\Windows Common Files\Commgr.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe
      "C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe"
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      PID:1936
  - - C:\Program Files\Windows Alerter\WinAlert.exe
      "C:\Program Files\Windows Alerter\WinAlert.exe"
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      PID:2400
- - C:\Program Files\Windows Alerter\WinAlert.exe
    "C:\Program Files\Windows Alerter\WinAlert.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3296
- - C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe
    "C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2456
- - C:\Program Files\Windows Alerter\WinAlert.exe
    "C:\Program Files\Windows Alerter\WinAlert.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe
      "C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe"
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      PID:3028
- - C:\Program Files\Windows Common Files\Commgr.exe
    "C:\Program Files\Windows Common Files\Commgr.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3032
- - C:\Program Files\Windows Common Files\Commgr.exe
    "C:\Program Files\Windows Common Files\Commgr.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2164
- - C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe
    "C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3932
- - C:\Program Files\Windows Alerter\WinAlert.exe
    "C:\Program Files\Windows Alerter\WinAlert.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4536
- - C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe
    "C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe"
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1140

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2376

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Alerter\WinAlert.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\Program Files\Windows Alerter\WinAlert.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\Program Files\Windows Alerter\WinAlert.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\Program Files\Windows Alerter\WinAlert.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\Program Files\Windows Alerter\WinAlert.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\Program Files\Windows Common Files\Commgr.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\Program Files\Windows Common Files\Commgr.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\Program Files\Windows Common Files\Commgr.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\Program Files\Windows Common Files\Commgr.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe

Filesize
400KB

MD5
701866df405b186ee9cd163328f8cd10

SHA1
f5eef955245e0b5a497e09c17eeb160742530875

SHA256
64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

SHA512
a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

Download Submit
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\bnf0342

Filesize
1B

MD5
00594fd4f42ba43fc1ca0427a0576295

SHA1
85e53271e14006f0265921d02d4d736cdc580b0b

SHA256
a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89

SHA512
6700df6600b118ab0432715a7e8a68b0bf37cdf4adaf0fb9e2b3ebe04ad19c7032cbad55e932792af360bafaa09962e2e690652bc075b2dad0c30688ba2f31a3

Download Submit
memory/1140-164-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1140-177-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1936-174-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2164-158-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2400-175-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2456-149-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2456-181-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3028-176-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3032-173-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3032-160-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3224-148-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3224-180-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3296-147-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3856-133-0x00000000023E0000-0x000000000346E000-memory.dmp

Filesize
16.6MB

Download
memory/3856-179-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3856-178-0x00000000023E0000-0x000000000346E000-memory.dmp

Filesize
16.6MB

Download
memory/3856-132-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3932-171-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3932-159-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4248-150-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4248-182-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4536-161-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4536-172-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download