b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Executioner.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Executioner.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Executioner = "C:\\Windows\\Executioner.exe"	Executioner.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Executioner.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
3800	Executioner.exe
4168	Executioner.exe

Sets file execution options in registry 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "rstrui.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "msconfig.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "taskmgr.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "regedit.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmsgs.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "calc.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "mspaint.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "wscript.exe"	Executioner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "msmsgs.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "regedt32.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe = "C:\\Windows\\Executioner.exe"	Executioner.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Executioner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Executioner = "C:\\Windows\\Executioner.exe"	Executioner.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dakila.nfo	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\SysWOW64\Dakila.nfo	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\SysWOW64\Dakila.nfo	Executioner.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\2.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MotionController_Hero.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Concrete.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page2.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\8.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\19.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-2.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page1.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\10.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\31.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_01.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sand.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page1.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\31.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\75.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-200.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_04.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FirstRunMailBlurred.layoutdir-RTL.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-1.exe	Executioner.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\avatar.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\27.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\7.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Wood.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG	Executioner.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_03.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Tracing.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg2.exe	Executioner.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\javascript_poster.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\39.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\3.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_Objects.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\2.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\3.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\40.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\12.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\0.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\7.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\9.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_04.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsGenericBackgroundImage.exe	Executioner.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\91.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_05.exe	Executioner.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\accessibility_poster.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\82.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\4.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\29.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\12.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\13.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\75.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireLargeTile.scale-100.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\13.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\27.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-3.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Success.exe	Executioner.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsCoreBackgroundImage.exe	Executioner.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Executioner.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File opened for modification	C:\Windows\Executioner.exe	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
File created	C:\Windows\Executioner.exe	Executioner.exe
File opened for modification	C:\Windows\Executioner.exe	Executioner.exe
File opened for modification	C:\Windows\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.jpg	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3492	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4504	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
3800	Executioner.exe
4168	Executioner.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3800	4504	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	81
PID 4504 wrote to memory of 3800	4504	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	81
PID 4504 wrote to memory of 3800	4504	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	81
PID 3800 wrote to memory of 4168	3800	Executioner.exe	82
PID 3800 wrote to memory of 4168	3800	Executioner.exe	82
PID 3800 wrote to memory of 4168	3800	Executioner.exe	82
PID 4504 wrote to memory of 3492	4504	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	83
PID 4504 wrote to memory of 3492	4504	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	83
PID 4504 wrote to memory of 3492	4504	b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe	83

C:\Users\Admin\AppData\Local\Temp\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
"C:\Users\Admin\AppData\Local\Temp\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\Executioner.exe
  C:\Windows\Executioner.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\Executioner.exe
    C:\Windows\Executioner.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\SHIMGVW.DLL,ImageView_Fullscreen C:\Windows\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.jpg
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:3492

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3764

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4572

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2068

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1932

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1156

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry