fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

Analysis

max time kernel
166s
max time network
170s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Size

162KB
MD5

f6710a928e7c123887bf5716b6ce3d72
SHA1

78ff43711800f8b55c90053ee469f317d5456855
SHA256

fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81
SHA512

948ca2b3fe6cf09dff33576b748d12812b97d6e85d9ec3b2cab91148c3d38c5fdcef6fcca8d2295d47bc9e19332eec0ec312b675460b5c52143ad40affb07742
SSDEEP

3072:SATjMpxXxgGvYskJLRiuyVisMekmUd0aIjwJczcvuo+wxmiAY/:BTjMpz6qnQ0b7gu1wE

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe\""	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe

Executes dropped EXE 1 IoCs

pid	Process
1976	NTKernel.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTKernel.exe\DisableExceptionChainValidation	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDMain.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWinSec.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blindman.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blindman.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFiles.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTKernel.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFiles.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDMain.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe\Debugger = "nqij.exe"	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe

Loads dropped DLL 2 IoCs

pid	Process
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NT Kernel\NTKernel.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
File opened for modification	C:\Windows\SysWOW64\NT Kernel\NTKernel.exe	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
File opened for modification	C:\Windows\SysWOW64\NT Kernel\	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1728 wrote to memory of 1904	1728	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	28
PID 1904 wrote to memory of 1976	1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	29
PID 1904 wrote to memory of 1976	1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	29
PID 1904 wrote to memory of 1976	1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	29
PID 1904 wrote to memory of 1976	1904	fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe	29

C:\Users\Admin\AppData\Local\Temp\fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
"C:\Users\Admin\AppData\Local\Temp\fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe
  "C:\Users\Admin\AppData\Local\Temp\fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\NT Kernel\NTKernel.exe
    "C:\Windows\system32\NT Kernel\NTKernel.exe"
    3⤵
    - Executes dropped EXE
    PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\NT Kernel\NTKernel.exe

Filesize
162KB

MD5
f6710a928e7c123887bf5716b6ce3d72

SHA1
78ff43711800f8b55c90053ee469f317d5456855

SHA256
fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

SHA512
948ca2b3fe6cf09dff33576b748d12812b97d6e85d9ec3b2cab91148c3d38c5fdcef6fcca8d2295d47bc9e19332eec0ec312b675460b5c52143ad40affb07742

Download Submit
C:\Windows\SysWOW64\NT Kernel\NTKernel.exe

Filesize
162KB

MD5
f6710a928e7c123887bf5716b6ce3d72

SHA1
78ff43711800f8b55c90053ee469f317d5456855

SHA256
fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

SHA512
948ca2b3fe6cf09dff33576b748d12812b97d6e85d9ec3b2cab91148c3d38c5fdcef6fcca8d2295d47bc9e19332eec0ec312b675460b5c52143ad40affb07742

Download Submit
\Windows\SysWOW64\NT Kernel\NTKernel.exe

Filesize
162KB

MD5
f6710a928e7c123887bf5716b6ce3d72

SHA1
78ff43711800f8b55c90053ee469f317d5456855

SHA256
fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

SHA512
948ca2b3fe6cf09dff33576b748d12812b97d6e85d9ec3b2cab91148c3d38c5fdcef6fcca8d2295d47bc9e19332eec0ec312b675460b5c52143ad40affb07742

Download Submit
\Windows\SysWOW64\NT Kernel\NTKernel.exe

Filesize
162KB

MD5
f6710a928e7c123887bf5716b6ce3d72

SHA1
78ff43711800f8b55c90053ee469f317d5456855

SHA256
fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

SHA512
948ca2b3fe6cf09dff33576b748d12812b97d6e85d9ec3b2cab91148c3d38c5fdcef6fcca8d2295d47bc9e19332eec0ec312b675460b5c52143ad40affb07742

Download Submit
memory/1728-68-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1728-55-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1728-56-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1728-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1904-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1904-65-0x0000000000402000-0x0000000000419600-memory.dmp

Filesize
93KB

Download
memory/1904-66-0x0000000000402000-0x0000000000419600-memory.dmp

Filesize
93KB

Download
memory/1904-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1904-63-0x000000000041952E-mapping.dmp

Download
memory/1904-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1904-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1904-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1904-75-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1904-77-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1976-71-0x0000000000000000-mapping.dmp

Download
memory/1976-76-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1976-78-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download