Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe
-
Size
704KB
-
MD5
26b67fe18705397aa22363c12e22ae54
-
SHA1
6648caac399f7e9a24fa6692430beca1ad581e79
-
SHA256
6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f
-
SHA512
bca1b2ba6835c2c0a600abc3d35bc4351c301813f1fc7edd7201cc47ec4bfcc86ee690c46c22bb153f68b9654be06840435c146f72570e3e0f110c6155741bb4
-
SSDEEP
6144:5cFvrd1rWkNYiclkBw1x42dy8r1YAbycKvN/+86JQPDHDdx/QtqV:u1dCicWy1xFc8r1NbZKvgPJQPDHvd
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xjnxejl.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe -
Adds policy Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjnxejl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjnxejl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzrpkdtvkeqiojambtnnf.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjnxejl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mjytlbonzqzorjxgsh.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wlsfpxctxg = "xvlharffskukohwgtjb.exe" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wlsfpxctxg = "xvlharffskukohwgtjb.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wlsfpxctxg = "wrexnbmjtipcdtfm.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wlsfpxctxg = "mjytlbonzqzorjxgsh.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wlsfpxctxg = "xvlharffskukohwgtjb.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjnxejl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wlsfpxctxg = "wrexnbmjtipcdtfm.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wlsfpxctxg = "zzrpkdtvkeqiojambtnnf.exe" xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjnxejl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrexnbmjtipcdtfm.exe" xjnxejl.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xjnxejl.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xjnxejl.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xjnxejl.exe -
Executes dropped EXE 2 IoCs
pid Process 1388 xjnxejl.exe 1976 xjnxejl.exe -
Loads dropped DLL 4 IoCs
pid Process 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "kjaxrjyzngrinhxiwngf.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "wrexnbmjtipcdtfm.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ofodpzgzfqtc = "kjaxrjyzngrinhxiwngf.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrexnbmjtipcdtfm.exe" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xjnxejl.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "zzrpkdtvkeqiojambtnnf.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "dznhynzxiyguwnait.exe" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ohsjxjsnvinyxl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mjytlbonzqzorjxgsh.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ohsjxjsnvinyxl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dznhynzxiyguwnait.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ofodpzgzfqtc = "mjytlbonzqzorjxgsh.exe ." 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "mjytlbonzqzorjxgsh.exe" xjnxejl.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "xvlharffskukohwgtjb.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ohsjxjsnvinyxl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mjytlbonzqzorjxgsh.exe" xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dznhynzxiyguwnait.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhpdoxdvakm = "mjytlbonzqzorjxgsh.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ofodpzgzfqtc = "mjytlbonzqzorjxgsh.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kjaxrjyzngrinhxiwngf.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ofodpzgzfqtc = "wrexnbmjtipcdtfm.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "mjytlbonzqzorjxgsh.exe ." 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpfsdlfmycmk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kjaxrjyzngrinhxiwngf.exe ." 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhpdoxdvakm = "wrexnbmjtipcdtfm.exe" xjnxejl.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "zzrpkdtvkeqiojambtnnf.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ohsjxjsnvinyxl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "zzrpkdtvkeqiojambtnnf.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ofodpzgzfqtc = "dznhynzxiyguwnait.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ohsjxjsnvinyxl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrexnbmjtipcdtfm.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "kjaxrjyzngrinhxiwngf.exe ." xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "kjaxrjyzngrinhxiwngf.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpfsdlfmycmk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzrpkdtvkeqiojambtnnf.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dznhynzxiyguwnait.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhpdoxdvakm = "zzrpkdtvkeqiojambtnnf.exe" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kjaxrjyzngrinhxiwngf.exe ." 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhpdoxdvakm = "zzrpkdtvkeqiojambtnnf.exe" xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ohsjxjsnvinyxl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dznhynzxiyguwnait.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhpdoxdvakm = "kjaxrjyzngrinhxiwngf.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ofodpzgzfqtc = "dznhynzxiyguwnait.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpfsdlfmycmk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mjytlbonzqzorjxgsh.exe ." xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhpdoxdvakm = "wrexnbmjtipcdtfm.exe" xjnxejl.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run xjnxejl.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpfsdlfmycmk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "xvlharffskukohwgtjb.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzrpkdtvkeqiojambtnnf.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpfsdlfmycmk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kjaxrjyzngrinhxiwngf.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dznhynzxiyguwnait.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kjaxrjyzngrinhxiwngf.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "kjaxrjyzngrinhxiwngf.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpfsdlfmycmk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvlharffskukohwgtjb.exe ." xjnxejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\drxjszdtw = "wrexnbmjtipcdtfm.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ofodpzgzfqtc = "kjaxrjyzngrinhxiwngf.exe ." xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzepxdgv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kjaxrjyzngrinhxiwngf.exe" xjnxejl.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhpdoxdvakm = "mjytlbonzqzorjxgsh.exe" xjnxejl.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xjnxejl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xjnxejl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xjnxejl.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 whatismyipaddress.com 10 whatismyip.everdot.org 12 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ofodpzgzfqtczltwclwnwlxhohnybkhtbe.tev xjnxejl.exe File created C:\Windows\SysWOW64\ofodpzgzfqtczltwclwnwlxhohnybkhtbe.tev xjnxejl.exe File opened for modification C:\Windows\SysWOW64\bhfjkjfniiaykliavttzxbc.xfa xjnxejl.exe File created C:\Windows\SysWOW64\bhfjkjfniiaykliavttzxbc.xfa xjnxejl.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\bhfjkjfniiaykliavttzxbc.xfa xjnxejl.exe File created C:\Program Files (x86)\bhfjkjfniiaykliavttzxbc.xfa xjnxejl.exe File opened for modification C:\Program Files (x86)\ofodpzgzfqtczltwclwnwlxhohnybkhtbe.tev xjnxejl.exe File created C:\Program Files (x86)\ofodpzgzfqtczltwclwnwlxhohnybkhtbe.tev xjnxejl.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\ofodpzgzfqtczltwclwnwlxhohnybkhtbe.tev xjnxejl.exe File opened for modification C:\Windows\bhfjkjfniiaykliavttzxbc.xfa xjnxejl.exe File created C:\Windows\bhfjkjfniiaykliavttzxbc.xfa xjnxejl.exe File opened for modification C:\Windows\ofodpzgzfqtczltwclwnwlxhohnybkhtbe.tev xjnxejl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1388 xjnxejl.exe 1388 xjnxejl.exe 1388 xjnxejl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1388 xjnxejl.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1388 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 26 PID 1492 wrote to memory of 1388 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 26 PID 1492 wrote to memory of 1388 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 26 PID 1492 wrote to memory of 1388 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 26 PID 1492 wrote to memory of 1976 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 27 PID 1492 wrote to memory of 1976 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 27 PID 1492 wrote to memory of 1976 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 27 PID 1492 wrote to memory of 1976 1492 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe 27 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xjnxejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xjnxejl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe"C:\Users\Admin\AppData\Local\Temp\6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\xjnxejl.exe"C:\Users\Admin\AppData\Local\Temp\xjnxejl.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\xjnxejl.exe"C:\Users\Admin\AppData\Local\Temp\xjnxejl.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:1976
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD508b2a242c5395d7aab65d798c1fea8fe
SHA15de719ca9a8642a7a5e13c8e476c0e2f53c05a73
SHA2567ab76db25461ac5133359ecf0d8d2f8a1f17c6d2aa67710f81a1a976251d5ab4
SHA512a05398a81aaa6cf5669ef4d95da2fac159358bbc4386776ec6ea606f75d3ef8694f8a80bfe3ce601d418ac44211a4f2adc42b62e7ade81dc3f9810814307fc5c
-
Filesize
1.2MB
MD508b2a242c5395d7aab65d798c1fea8fe
SHA15de719ca9a8642a7a5e13c8e476c0e2f53c05a73
SHA2567ab76db25461ac5133359ecf0d8d2f8a1f17c6d2aa67710f81a1a976251d5ab4
SHA512a05398a81aaa6cf5669ef4d95da2fac159358bbc4386776ec6ea606f75d3ef8694f8a80bfe3ce601d418ac44211a4f2adc42b62e7ade81dc3f9810814307fc5c
-
Filesize
1.2MB
MD508b2a242c5395d7aab65d798c1fea8fe
SHA15de719ca9a8642a7a5e13c8e476c0e2f53c05a73
SHA2567ab76db25461ac5133359ecf0d8d2f8a1f17c6d2aa67710f81a1a976251d5ab4
SHA512a05398a81aaa6cf5669ef4d95da2fac159358bbc4386776ec6ea606f75d3ef8694f8a80bfe3ce601d418ac44211a4f2adc42b62e7ade81dc3f9810814307fc5c
-
Filesize
1.2MB
MD508b2a242c5395d7aab65d798c1fea8fe
SHA15de719ca9a8642a7a5e13c8e476c0e2f53c05a73
SHA2567ab76db25461ac5133359ecf0d8d2f8a1f17c6d2aa67710f81a1a976251d5ab4
SHA512a05398a81aaa6cf5669ef4d95da2fac159358bbc4386776ec6ea606f75d3ef8694f8a80bfe3ce601d418ac44211a4f2adc42b62e7ade81dc3f9810814307fc5c
-
Filesize
1.2MB
MD508b2a242c5395d7aab65d798c1fea8fe
SHA15de719ca9a8642a7a5e13c8e476c0e2f53c05a73
SHA2567ab76db25461ac5133359ecf0d8d2f8a1f17c6d2aa67710f81a1a976251d5ab4
SHA512a05398a81aaa6cf5669ef4d95da2fac159358bbc4386776ec6ea606f75d3ef8694f8a80bfe3ce601d418ac44211a4f2adc42b62e7ade81dc3f9810814307fc5c
-
Filesize
1.2MB
MD508b2a242c5395d7aab65d798c1fea8fe
SHA15de719ca9a8642a7a5e13c8e476c0e2f53c05a73
SHA2567ab76db25461ac5133359ecf0d8d2f8a1f17c6d2aa67710f81a1a976251d5ab4
SHA512a05398a81aaa6cf5669ef4d95da2fac159358bbc4386776ec6ea606f75d3ef8694f8a80bfe3ce601d418ac44211a4f2adc42b62e7ade81dc3f9810814307fc5c