description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	inetinfo.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts-Denied By-Admin.com	inetinfo.exe
File created	C:\Windows\System32\drivers\etc\hosts-Denied By-Admin.com	inetinfo.exe

pid	Process
5048	smss.exe
4868	winlogon.exe
1296	services.exe
116	lsass.exe
2112	inetinfo.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif	smss.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif	smss.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\ElnorB.exe\""	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\ElnorB.exe\""	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\""	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\""	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\""	inetinfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\""	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\ElnorB.exe\""	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\""	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\ElnorB.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\ElnorB.exe\""	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\ElnorB.exe\""	inetinfo.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\Admin's Setting.scr	smss.exe
File opened for modification	C:\Windows\SysWOW64\Admin's Setting.scr	smss.exe

description	ioc	Process
File created	C:\Windows\ShellNew\ElnorB.exe	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe
File opened for modification	C:\Windows\ShellNew\ElnorB.exe	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe
File opened for modification	C:\Windows\ShellNew\ElnorB.exe	smss.exe
File opened for modification	C:\Windows\ShellNew\ElnorB.exe	winlogon.exe
File opened for modification	C:\Windows\ShellNew\ElnorB.exe	services.exe
File opened for modification	C:\Windows\ShellNew\ElnorB.exe	lsass.exe
File opened for modification	C:\Windows\ShellNew\ElnorB.exe	inetinfo.exe

pid	Process
3208	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe
5048	smss.exe
4868	winlogon.exe
1296	services.exe
116	lsass.exe
2112	inetinfo.exe

description	pid	Process	procid_target
PID 3208 wrote to memory of 3752	3208	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe	81
PID 3208 wrote to memory of 3752	3208	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe	81
PID 3208 wrote to memory of 3752	3208	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe	81
PID 3208 wrote to memory of 5048	3208	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe	82
PID 3208 wrote to memory of 5048	3208	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe	82
PID 3208 wrote to memory of 5048	3208	c00c2ee8a103e5780685d38c4a8d250203dc1da9757a2dee08e10a7c3d84a4d8.exe	82
PID 5048 wrote to memory of 4868	5048	smss.exe	83
PID 5048 wrote to memory of 4868	5048	smss.exe	83
PID 5048 wrote to memory of 4868	5048	smss.exe	83
PID 5048 wrote to memory of 1028	5048	smss.exe	85
PID 5048 wrote to memory of 1028	5048	smss.exe	85
PID 5048 wrote to memory of 1028	5048	smss.exe	85
PID 5048 wrote to memory of 1292	5048	smss.exe	87
PID 5048 wrote to memory of 1292	5048	smss.exe	87
PID 5048 wrote to memory of 1292	5048	smss.exe	87
PID 5048 wrote to memory of 1296	5048	smss.exe	88
PID 5048 wrote to memory of 1296	5048	smss.exe	88
PID 5048 wrote to memory of 1296	5048	smss.exe	88
PID 5048 wrote to memory of 116	5048	smss.exe	90
PID 5048 wrote to memory of 116	5048	smss.exe	90
PID 5048 wrote to memory of 116	5048	smss.exe	90
PID 5048 wrote to memory of 2112	5048	smss.exe	91
PID 5048 wrote to memory of 2112	5048	smss.exe	91
PID 5048 wrote to memory of 2112	5048	smss.exe	91

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.