Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 23:53
Static task
static1
Behavioral task
behavioral1
Sample
6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe
-
Size
320KB
-
MD5
04b4b2f130705e6e22e4b940f5df3a90
-
SHA1
d1ea0bf314bfb75b669bae9e2750fd55fe41077a
-
SHA256
6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb
-
SHA512
28fc9a38f7e73f09f75de2d73e99983875967140fd3a80330ddfa63351d0ffb97b5bc83acb9ddf2c55b503b857231044211eaa038aab0fc1304d99702657fc57
-
SSDEEP
6144:jTw1o1IV3puaibGKFHi0mofhaH05kipz016580bHFP86JQPDHDdx/QtqR:nTgvmzFHi0mo5aH0qMzd5807FPPJQPDV
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wdltt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe -
Adds policy Run key to start application 2 TTPs 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzodkwjtkhqn = "jdytgyrhehwzrfoapd.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxjnwgnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlexiypdyzmndpwg.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxjnwgnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaxmgbtsxotndoctjfc.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxjnwgnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrpfawppvntofrgypmki.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxjnwgnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlexiypdyzmndpwg.exe" wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxjnwgnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrpfawppvntofrgypmki.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzodkwjtkhqn = "tlexiypdyzmndpwg.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzodkwjtkhqn = "hdaxmgbtsxotndoctjfc.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxjnwgnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdytgyrhehwzrfoapd.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzodkwjtkhqn = "atnhtkcrnpdfwjrcq.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzodkwjtkhqn = "uplhvoizxbrvodnaqfa.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzodkwjtkhqn = "wtrpfawppvntofrgypmki.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzodkwjtkhqn = "tlexiypdyzmndpwg.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxjnwgnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uplhvoizxbrvodnaqfa.exe" wdltt.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdltt.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdltt.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdltt.exe -
Executes dropped EXE 2 IoCs
pid Process 964 wdltt.exe 1656 wdltt.exe -
Loads dropped DLL 4 IoCs
pid Process 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbsjsgvhazkjxh = "hdaxmgbtsxotndoctjfc.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzpfnaozrpzxk = "tlexiypdyzmndpwg.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "hdaxmgbtsxotndoctjfc.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxpzoerllxxmxd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlexiypdyzmndpwg.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnhtkcrnpdfwjrcq.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxpzoerllxxmxd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaxmgbtsxotndoctjfc.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrpfawppvntofrgypmki.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "wtrpfawppvntofrgypmki.exe" wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlexiypdyzmndpwg.exe" wdltt.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaxmgbtsxotndoctjfc.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "atnhtkcrnpdfwjrcq.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "wtrpfawppvntofrgypmki.exe ." wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "uplhvoizxbrvodnaqfa.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "jdytgyrhehwzrfoapd.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlexiypdyzmndpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnhtkcrnpdfwjrcq.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdytgyrhehwzrfoapd.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbsjsgvhazkjxh = "hdaxmgbtsxotndoctjfc.exe ." wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlexiypdyzmndpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrpfawppvntofrgypmki.exe" wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdytgyrhehwzrfoapd.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "uplhvoizxbrvodnaqfa.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbsjsgvhazkjxh = "wtrpfawppvntofrgypmki.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxpzoerllxxmxd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdytgyrhehwzrfoapd.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrpfawppvntofrgypmki.exe" wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnhtkcrnpdfwjrcq.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxpzoerllxxmxd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdytgyrhehwzrfoapd.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce wdltt.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzpfnaozrpzxk = "hdaxmgbtsxotndoctjfc.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlexiypdyzmndpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlexiypdyzmndpwg.exe" wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnhtkcrnpdfwjrcq.exe" wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrpfawppvntofrgypmki.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaxmgbtsxotndoctjfc.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbsjsgvhazkjxh = "atnhtkcrnpdfwjrcq.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaxmgbtsxotndoctjfc.exe" wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbsjsgvhazkjxh = "jdytgyrhehwzrfoapd.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "uplhvoizxbrvodnaqfa.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzpfnaozrpzxk = "tlexiypdyzmndpwg.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxpzoerllxxmxd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrpfawppvntofrgypmki.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "jdytgyrhehwzrfoapd.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "hdaxmgbtsxotndoctjfc.exe" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wdltt.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbsjsgvhazkjxh = "tlexiypdyzmndpwg.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzpfnaozrpzxk = "tlexiypdyzmndpwg.exe" wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzpfnaozrpzxk = "jdytgyrhehwzrfoapd.exe" wdltt.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbsjsgvhazkjxh = "tlexiypdyzmndpwg.exe ." 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzpfnaozrpzxk = "hdaxmgbtsxotndoctjfc.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlexiypdyzmndpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrpfawppvntofrgypmki.exe" wdltt.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "hdaxmgbtsxotndoctjfc.exe" wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbsjsgvhazkjxh = "tlexiypdyzmndpwg.exe ." wdltt.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\obpdjugpfbj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uplhvoizxbrvodnaqfa.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlexiypdyzmndpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdytgyrhehwzrfoapd.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxpzoerllxxmxd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnhtkcrnpdfwjrcq.exe ." wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlexiypdyzmndpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaxmgbtsxotndoctjfc.exe" wdltt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "wtrpfawppvntofrgypmki.exe" wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfsfkufncx = "atnhtkcrnpdfwjrcq.exe" wdltt.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdltt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdltt.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 whatismyip.everdot.org 9 whatismyipaddress.com 11 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\lzodkwjtkhqnzhkqzhvkzgsfpgdmjvdgmv.rgv wdltt.exe File created C:\Windows\SysWOW64\lzodkwjtkhqnzhkqzhvkzgsfpgdmjvdgmv.rgv wdltt.exe File opened for modification C:\Windows\SysWOW64\ybfjfgihnzxjkhzuspswawx.yeq wdltt.exe File created C:\Windows\SysWOW64\ybfjfgihnzxjkhzuspswawx.yeq wdltt.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ybfjfgihnzxjkhzuspswawx.yeq wdltt.exe File created C:\Program Files (x86)\ybfjfgihnzxjkhzuspswawx.yeq wdltt.exe File opened for modification C:\Program Files (x86)\lzodkwjtkhqnzhkqzhvkzgsfpgdmjvdgmv.rgv wdltt.exe File created C:\Program Files (x86)\lzodkwjtkhqnzhkqzhvkzgsfpgdmjvdgmv.rgv wdltt.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\ybfjfgihnzxjkhzuspswawx.yeq wdltt.exe File opened for modification C:\Windows\lzodkwjtkhqnzhkqzhvkzgsfpgdmjvdgmv.rgv wdltt.exe File created C:\Windows\lzodkwjtkhqnzhkqzhvkzgsfpgdmjvdgmv.rgv wdltt.exe File opened for modification C:\Windows\ybfjfgihnzxjkhzuspswawx.yeq wdltt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 964 wdltt.exe 964 wdltt.exe 964 wdltt.exe 964 wdltt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 964 wdltt.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1384 wrote to memory of 964 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 27 PID 1384 wrote to memory of 964 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 27 PID 1384 wrote to memory of 964 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 27 PID 1384 wrote to memory of 964 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 27 PID 1384 wrote to memory of 1656 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 28 PID 1384 wrote to memory of 1656 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 28 PID 1384 wrote to memory of 1656 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 28 PID 1384 wrote to memory of 1656 1384 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe 28 -
System policy modification 1 TTPs 32 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wdltt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wdltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe"C:\Users\Admin\AppData\Local\Temp\6b95cb36974c66e4ae11c293e2e8ac530815db72356edcf25df221f181a119cb.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\wdltt.exe"C:\Users\Admin\AppData\Local\Temp\wdltt.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:964
-
-
C:\Users\Admin\AppData\Local\Temp\wdltt.exe"C:\Users\Admin\AppData\Local\Temp\wdltt.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:1656
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
712KB
MD5cd283d56c9159811f425578d0ec0ec55
SHA15c99a7365de2be80bb3d7fc8c96278c558a37b3d
SHA2567e6a3813dc6ca59c5b943a456604e2c3689617078784e0a7430da64a5332a89c
SHA51275d3119beb02a08a0d0069ae24f547d5f9fefa7b48ab0af082f8da06f5efefad2b3e0e8c837c1bdb03922a3068f44e79afb3431fe9ac0da86c011262d6e7e3db
-
Filesize
712KB
MD5cd283d56c9159811f425578d0ec0ec55
SHA15c99a7365de2be80bb3d7fc8c96278c558a37b3d
SHA2567e6a3813dc6ca59c5b943a456604e2c3689617078784e0a7430da64a5332a89c
SHA51275d3119beb02a08a0d0069ae24f547d5f9fefa7b48ab0af082f8da06f5efefad2b3e0e8c837c1bdb03922a3068f44e79afb3431fe9ac0da86c011262d6e7e3db
-
Filesize
712KB
MD5cd283d56c9159811f425578d0ec0ec55
SHA15c99a7365de2be80bb3d7fc8c96278c558a37b3d
SHA2567e6a3813dc6ca59c5b943a456604e2c3689617078784e0a7430da64a5332a89c
SHA51275d3119beb02a08a0d0069ae24f547d5f9fefa7b48ab0af082f8da06f5efefad2b3e0e8c837c1bdb03922a3068f44e79afb3431fe9ac0da86c011262d6e7e3db
-
Filesize
712KB
MD5cd283d56c9159811f425578d0ec0ec55
SHA15c99a7365de2be80bb3d7fc8c96278c558a37b3d
SHA2567e6a3813dc6ca59c5b943a456604e2c3689617078784e0a7430da64a5332a89c
SHA51275d3119beb02a08a0d0069ae24f547d5f9fefa7b48ab0af082f8da06f5efefad2b3e0e8c837c1bdb03922a3068f44e79afb3431fe9ac0da86c011262d6e7e3db
-
Filesize
712KB
MD5cd283d56c9159811f425578d0ec0ec55
SHA15c99a7365de2be80bb3d7fc8c96278c558a37b3d
SHA2567e6a3813dc6ca59c5b943a456604e2c3689617078784e0a7430da64a5332a89c
SHA51275d3119beb02a08a0d0069ae24f547d5f9fefa7b48ab0af082f8da06f5efefad2b3e0e8c837c1bdb03922a3068f44e79afb3431fe9ac0da86c011262d6e7e3db
-
Filesize
712KB
MD5cd283d56c9159811f425578d0ec0ec55
SHA15c99a7365de2be80bb3d7fc8c96278c558a37b3d
SHA2567e6a3813dc6ca59c5b943a456604e2c3689617078784e0a7430da64a5332a89c
SHA51275d3119beb02a08a0d0069ae24f547d5f9fefa7b48ab0af082f8da06f5efefad2b3e0e8c837c1bdb03922a3068f44e79afb3431fe9ac0da86c011262d6e7e3db