b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dakila.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dakila.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dakila = "C:\\Windows\\dakila.exe"	dakila.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	dakila.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
1684	dakila.exe
1976	dakila.exe

Sets file execution options in registry 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "msmsgs.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "calc.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "mspaint.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "regedit.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmsgs.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "rstrui.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "wscript.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe = "C:\\Windows\\dakila.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "msconfig.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "taskmgr.exe"	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "regedt32.exe"	dakila.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	dakila.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	dakila.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dakila = "C:\\Windows\\dakila.exe"	dakila.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dakila.nfo	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\SysWOW64\Dakila.nfo	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\SysWOW64\Dakila.nfo	dakila.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148757.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0289430.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382965.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099167.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382960.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.exe	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.exe	dakila.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175361.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182689.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.exe	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309598.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341654.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01179J.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099189.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313896.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03143I.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.exe	dakila.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.exe	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099154.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTAREA.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382957.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382962.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.exe	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149118.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341534.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382930.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382967.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.exe	dakila.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382954.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\STOPICON.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTVIEW.JPG	dakila.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.exe	dakila.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.exe	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148309.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.exe	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148798.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382955.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384895.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386270.JPG	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Medium.exe	dakila.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.exe	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099156.JPG	dakila.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0164153.JPG	dakila.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp3.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp4.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp5.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp1.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp3.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp4.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp2.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp2.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp6.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp4.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp4.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp5.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.exe	dakila.exe
File opened for modification	C:\Windows\dakila.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp1.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp2.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp3.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp5.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp6.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp1.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp3.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp4.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp4.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp6.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.exe	dakila.exe
File created	C:\Windows\dakila.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp6.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp2.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp6.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp1.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp4.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File created	C:\Windows\dakila.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\dakila.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp5.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp1.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp3.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp5.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp2.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp2.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp6.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp1.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp3.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp1.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.exe	dakila.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.exe	dakila.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp2.exe	dakila.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1920	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
1684	dakila.exe
1976	dakila.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1684	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	27
PID 900 wrote to memory of 1684	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	27
PID 900 wrote to memory of 1684	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	27
PID 900 wrote to memory of 1684	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	27
PID 1684 wrote to memory of 1976	1684	dakila.exe	28
PID 1684 wrote to memory of 1976	1684	dakila.exe	28
PID 1684 wrote to memory of 1976	1684	dakila.exe	28
PID 1684 wrote to memory of 1976	1684	dakila.exe	28
PID 900 wrote to memory of 1920	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	29
PID 900 wrote to memory of 1920	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	29
PID 900 wrote to memory of 1920	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	29
PID 900 wrote to memory of 1920	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	29
PID 900 wrote to memory of 1920	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	29
PID 900 wrote to memory of 1920	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	29
PID 900 wrote to memory of 1920	900	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	29

C:\Users\Admin\AppData\Local\Temp\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
"C:\Users\Admin\AppData\Local\Temp\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\dakila.exe
  C:\Windows\dakila.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\dakila.exe
    C:\Windows\dakila.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\SHIMGVW.DLL,ImageView_Fullscreen C:\Windows\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.jpg
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry