226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0

Analysis

max time kernel
153s
max time network
111s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Size

328KB
MD5

43ca9513dcd1ac5ed7956af299de64a0
SHA1

af57c6b3280ccabc7ac1c330a42c2fb357f27283
SHA256

226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0
SHA512

c72b08e13a81f39494a044e8b5b1c022ea62eb87ecccb0358fd2152104ba27cb8956d0f99b04dbe27ca970753837f47937232a5da09d3069d7f5b51c646f4541
SSDEEP

6144:gYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO85DajV3fH:gSNC80I+cR3R03VseuO8523f

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe gphone.exe"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Disables Task Manager via registry modification
evasion

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/976-57-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral1/memory/1652-60-0x0000000000400000-0x00000000004B2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\gphone.exe"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\N:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\Q:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\R:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\Y:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\E:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\G:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\I:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\S:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\J:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\O:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\P:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\M:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\U:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\V:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\X:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\Z:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\F:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\H:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\L:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\T:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened (read-only)	\??\W:	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/976-57-0x0000000000400000-0x00000000004B2000-memory.dmp	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\runouce.exe	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File created	C:\Windows\SysWOW64\gphone.exe	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened for modification	C:\Windows\SysWOW64\gphone.exe	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File created	C:\Windows\SysWOW64\runouce.exe	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened for modification	C:\WINDOWS\SysWOW64\RUNOUCE.EXE	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\gphone.exe	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
File opened for modification	C:\Windows\gphone.exe	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://rnd009.googlepages.com/google.html"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://rnd009.googlepages.com/google.html"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://rnd009.googlepages.com/google.html"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://rnd009.googlepages.com/google.html"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://rnd009.googlepages.com/google.html"	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Token: SeTakeOwnershipPrivilege	1652	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Token: SeRestorePrivilege	1652	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Token: SeBackupPrivilege	1652	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
Token: SeChangeNotifyPrivilege	1652	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 976	1652	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	27
PID 1652 wrote to memory of 976	1652	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	27
PID 1652 wrote to memory of 976	1652	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	27
PID 1652 wrote to memory of 976	1652	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	27
PID 976 wrote to memory of 368	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	24
PID 976 wrote to memory of 368	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	24
PID 976 wrote to memory of 368	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	24
PID 976 wrote to memory of 368	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	24
PID 976 wrote to memory of 368	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	24
PID 976 wrote to memory of 368	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	24
PID 976 wrote to memory of 380	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	23
PID 976 wrote to memory of 380	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	23
PID 976 wrote to memory of 380	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	23
PID 976 wrote to memory of 380	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	23
PID 976 wrote to memory of 380	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	23
PID 976 wrote to memory of 380	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	23
PID 976 wrote to memory of 416	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	22
PID 976 wrote to memory of 416	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	22
PID 976 wrote to memory of 416	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	22
PID 976 wrote to memory of 416	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	22
PID 976 wrote to memory of 416	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	22
PID 976 wrote to memory of 416	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	22
PID 976 wrote to memory of 460	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	2
PID 976 wrote to memory of 460	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	2
PID 976 wrote to memory of 460	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	2
PID 976 wrote to memory of 460	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	2
PID 976 wrote to memory of 460	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	2
PID 976 wrote to memory of 460	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	2
PID 976 wrote to memory of 476	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	1
PID 976 wrote to memory of 476	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	1
PID 976 wrote to memory of 476	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	1
PID 976 wrote to memory of 476	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	1
PID 976 wrote to memory of 476	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	1
PID 976 wrote to memory of 476	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	1
PID 976 wrote to memory of 484	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	21
PID 976 wrote to memory of 484	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	21
PID 976 wrote to memory of 484	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	21
PID 976 wrote to memory of 484	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	21
PID 976 wrote to memory of 484	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	21
PID 976 wrote to memory of 484	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	21
PID 976 wrote to memory of 576	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	20
PID 976 wrote to memory of 576	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	20
PID 976 wrote to memory of 576	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	20
PID 976 wrote to memory of 576	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	20
PID 976 wrote to memory of 576	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	20
PID 976 wrote to memory of 576	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	20
PID 976 wrote to memory of 652	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	19
PID 976 wrote to memory of 652	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	19
PID 976 wrote to memory of 652	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	19
PID 976 wrote to memory of 652	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	19
PID 976 wrote to memory of 652	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	19
PID 976 wrote to memory of 652	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	19
PID 976 wrote to memory of 740	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	18
PID 976 wrote to memory of 740	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	18
PID 976 wrote to memory of 740	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	18
PID 976 wrote to memory of 740	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	18
PID 976 wrote to memory of 740	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	18
PID 976 wrote to memory of 740	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	18
PID 976 wrote to memory of 792	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	17
PID 976 wrote to memory of 792	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	17
PID 976 wrote to memory of 792	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	17
PID 976 wrote to memory of 792	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	17
PID 976 wrote to memory of 792	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	17
PID 976 wrote to memory of 792	976	226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe	17

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:772
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1700
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1128
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1040
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1012
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:1020
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:860
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:836
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:792
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:740
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:652
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:576

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1832

C:\Users\Admin\AppData\Local\Temp\226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
"C:\Users\Admin\AppData\Local\Temp\226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe
  "C:\Users\Admin\AppData\Local\Temp\226a5f5a855b7212c6a0c3724cf6e2a809bbf875048b77695f49771d54db42e0.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Disables RegEdit via registry modification
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:976

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1244

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1276-58-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/1652-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1652-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1652-62-0x00000000FFFA0000-0x00000000FFFA9000-memory.dmp

Filesize
36KB

Download
memory/1652-61-0x0000000000150000-0x0000000000202000-memory.dmp

Filesize
712KB

Download
memory/1652-63-0x00000000FFFA0000-0x00000000FFFA9000-memory.dmp

Filesize
36KB

Download