Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-10-2022 03:41
Static task
static1
Behavioral task
behavioral1
Sample
d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe
-
Size
2.0MB
-
MD5
4baba246d86b3ae08fb2dc9a490be040
-
SHA1
6bc3ab2e5d1028da543dcbf6e2d343a330e99f53
-
SHA256
d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f
-
SHA512
2037339888c6cebf47c1ce162004f47ed0093b37ab14b9d577cc272fcd1d1fc2278ed5afd94bd9ce36bf6c1d4b6b0f77d0ca6e60cbfb493a4919b98555a29c7a
-
SSDEEP
6144:JcFvrd1rWkNYiclkBw1x42dy8r1YAbycKkub86JQPDHDdx/QtqV:+1dCicWy1xFc8r1NbZKbPJQPDHvd
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ximkv.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ximkv.exe -
Adds policy Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hqs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xysghxtomdqiojambtlmg.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hqs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iiboodyspfrinhxiwnee.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iuzykl = "xysghxtomdqiojambtlmg.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iuzykl = "uqfokvmcvhpcdtfm.exe" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iuzykl = "byoyvhzqkxguwnait.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hqs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iiboodyspfrinhxiwnee.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hqs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kizkivogbpzorjxgsh.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hqs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byoyvhzqkxguwnait.exe" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hqs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xysghxtomdqiojambtlmg.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iuzykl = "kizkivogbpzorjxgsh.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iuzykl = "uqfokvmcvhpcdtfm.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hqs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uqfokvmcvhpcdtfm.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iuzykl = "xysghxtomdqiojambtlmg.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iuzykl = "uqfokvmcvhpcdtfm.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hqs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uqfokvmcvhpcdtfm.exe" ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ximkv.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ximkv.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ximkv.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe -
Executes dropped EXE 2 IoCs
pid Process 1868 ximkv.exe 1944 ximkv.exe -
Loads dropped DLL 4 IoCs
pid Process 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "byoyvhzqkxguwnait.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\oyby = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byoyvhzqkxguwnait.exe" ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "xysghxtomdqiojambtlmg.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uktwmrcmzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vumyxlfyujukohwgtjz.exe" ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ximkv.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vumyxlfyujukohwgtjz.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "kizkivogbpzorjxgsh.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioobdl = "uqfokvmcvhpcdtfm.exe" ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uqfokvmcvhpcdtfm.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyby = "kizkivogbpzorjxgsh.exe" ximkv.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bqyaptdmy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uqfokvmcvhpcdtfm.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\oyby = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uqfokvmcvhpcdtfm.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "uqfokvmcvhpcdtfm.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyby = "kizkivogbpzorjxgsh.exe" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uktwmrcmzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kizkivogbpzorjxgsh.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyby = "uqfokvmcvhpcdtfm.exe" ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioobdl = "xysghxtomdqiojambtlmg.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bqyaptdmy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kizkivogbpzorjxgsh.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byoyvhzqkxguwnait.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vumyxlfyujukohwgtjz.exe ." d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "xysghxtomdqiojambtlmg.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioobdl = "vumyxlfyujukohwgtjz.exe" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uktwmrcmzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vumyxlfyujukohwgtjz.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "uqfokvmcvhpcdtfm.exe ." d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kizkivogbpzorjxgsh.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uktwmrcmzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byoyvhzqkxguwnait.exe" ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kyfguxgo = "vumyxlfyujukohwgtjz.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bqyaptdmy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kizkivogbpzorjxgsh.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uqfokvmcvhpcdtfm.exe ." ximkv.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyby = "byoyvhzqkxguwnait.exe" ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kyfguxgo = "byoyvhzqkxguwnait.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bqyaptdmy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byoyvhzqkxguwnait.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\oyby = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byoyvhzqkxguwnait.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bqyaptdmy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xysghxtomdqiojambtlmg.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kyfguxgo = "byoyvhzqkxguwnait.exe ." d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bqyaptdmy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kizkivogbpzorjxgsh.exe ." d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byoyvhzqkxguwnait.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kyfguxgo = "uqfokvmcvhpcdtfm.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kyfguxgo = "byoyvhzqkxguwnait.exe ." ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kyfguxgo = "kizkivogbpzorjxgsh.exe ." ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioobdl = "xysghxtomdqiojambtlmg.exe" ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioobdl = "vumyxlfyujukohwgtjz.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uktwmrcmzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uqfokvmcvhpcdtfm.exe" ximkv.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioobdl = "uqfokvmcvhpcdtfm.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uktwmrcmzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kizkivogbpzorjxgsh.exe" ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyby = "byoyvhzqkxguwnait.exe" ximkv.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioobdl = "iiboodyspfrinhxiwnee.exe" ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ximkv = "iiboodyspfrinhxiwnee.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyby = "xysghxtomdqiojambtlmg.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bqyaptdmy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iiboodyspfrinhxiwnee.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bqyaptdmy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vumyxlfyujukohwgtjz.exe ." ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uktwmrcmzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iiboodyspfrinhxiwnee.exe" ximkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uktwmrcmzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uqfokvmcvhpcdtfm.exe" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ximkv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ximkv.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 www.showmyipaddress.com 5 whatismyip.everdot.org 6 whatismyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\zecuzttsupgcmlgwplhmk.hbb ximkv.exe File opened for modification C:\Windows\SysWOW64\uktwmrcmzfhojtzaelsirukpakxdfmhr.ycj ximkv.exe File created C:\Windows\SysWOW64\uktwmrcmzfhojtzaelsirukpakxdfmhr.ycj ximkv.exe File opened for modification C:\Windows\SysWOW64\zecuzttsupgcmlgwplhmk.hbb ximkv.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\zecuzttsupgcmlgwplhmk.hbb ximkv.exe File created C:\Program Files (x86)\zecuzttsupgcmlgwplhmk.hbb ximkv.exe File opened for modification C:\Program Files (x86)\uktwmrcmzfhojtzaelsirukpakxdfmhr.ycj ximkv.exe File created C:\Program Files (x86)\uktwmrcmzfhojtzaelsirukpakxdfmhr.ycj ximkv.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\zecuzttsupgcmlgwplhmk.hbb ximkv.exe File created C:\Windows\zecuzttsupgcmlgwplhmk.hbb ximkv.exe File opened for modification C:\Windows\uktwmrcmzfhojtzaelsirukpakxdfmhr.ycj ximkv.exe File created C:\Windows\uktwmrcmzfhojtzaelsirukpakxdfmhr.ycj ximkv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1944 ximkv.exe 1944 ximkv.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1944 ximkv.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 364 wrote to memory of 1868 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 26 PID 364 wrote to memory of 1868 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 26 PID 364 wrote to memory of 1868 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 26 PID 364 wrote to memory of 1868 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 26 PID 364 wrote to memory of 1944 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 27 PID 364 wrote to memory of 1944 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 27 PID 364 wrote to memory of 1944 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 27 PID 364 wrote to memory of 1944 364 d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe 27 -
System policy modification 1 TTPs 33 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ximkv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ximkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ximkv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe"C:\Users\Admin\AppData\Local\Temp\d16605e415481e1825eb32856c4453937080bd0db67b028ea4a8d46aac03d43f.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:364 -
C:\Users\Admin\AppData\Local\Temp\ximkv.exe"C:\Users\Admin\AppData\Local\Temp\ximkv.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:1868
-
-
C:\Users\Admin\AppData\Local\Temp\ximkv.exe"C:\Users\Admin\AppData\Local\Temp\ximkv.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1944
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD53e71fcd468f2a704a9cb335ab1454cb0
SHA10faaa9e5a02c15992014bec2beb02ae00dd8621c
SHA256fce06cae6d1c841ac48dec24e4cd4f789a40b3f9256fe937360a9d1da1e751f3
SHA512c3aacda4c3dc1521ee950247a02d73ae74658e415c3c7f7474c7adf8d77aeb807eecfc9f9f83748f5d4105cec20382a710c6c30f2dc3d8e543e452b70638839e
-
Filesize
3.0MB
MD53e71fcd468f2a704a9cb335ab1454cb0
SHA10faaa9e5a02c15992014bec2beb02ae00dd8621c
SHA256fce06cae6d1c841ac48dec24e4cd4f789a40b3f9256fe937360a9d1da1e751f3
SHA512c3aacda4c3dc1521ee950247a02d73ae74658e415c3c7f7474c7adf8d77aeb807eecfc9f9f83748f5d4105cec20382a710c6c30f2dc3d8e543e452b70638839e
-
Filesize
3.0MB
MD53e71fcd468f2a704a9cb335ab1454cb0
SHA10faaa9e5a02c15992014bec2beb02ae00dd8621c
SHA256fce06cae6d1c841ac48dec24e4cd4f789a40b3f9256fe937360a9d1da1e751f3
SHA512c3aacda4c3dc1521ee950247a02d73ae74658e415c3c7f7474c7adf8d77aeb807eecfc9f9f83748f5d4105cec20382a710c6c30f2dc3d8e543e452b70638839e
-
Filesize
3.0MB
MD53e71fcd468f2a704a9cb335ab1454cb0
SHA10faaa9e5a02c15992014bec2beb02ae00dd8621c
SHA256fce06cae6d1c841ac48dec24e4cd4f789a40b3f9256fe937360a9d1da1e751f3
SHA512c3aacda4c3dc1521ee950247a02d73ae74658e415c3c7f7474c7adf8d77aeb807eecfc9f9f83748f5d4105cec20382a710c6c30f2dc3d8e543e452b70638839e
-
Filesize
3.0MB
MD53e71fcd468f2a704a9cb335ab1454cb0
SHA10faaa9e5a02c15992014bec2beb02ae00dd8621c
SHA256fce06cae6d1c841ac48dec24e4cd4f789a40b3f9256fe937360a9d1da1e751f3
SHA512c3aacda4c3dc1521ee950247a02d73ae74658e415c3c7f7474c7adf8d77aeb807eecfc9f9f83748f5d4105cec20382a710c6c30f2dc3d8e543e452b70638839e
-
Filesize
3.0MB
MD53e71fcd468f2a704a9cb335ab1454cb0
SHA10faaa9e5a02c15992014bec2beb02ae00dd8621c
SHA256fce06cae6d1c841ac48dec24e4cd4f789a40b3f9256fe937360a9d1da1e751f3
SHA512c3aacda4c3dc1521ee950247a02d73ae74658e415c3c7f7474c7adf8d77aeb807eecfc9f9f83748f5d4105cec20382a710c6c30f2dc3d8e543e452b70638839e