abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07

Analysis

max time kernel
153s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Size

320KB
MD5

3902133038bb344e9bdfde7cfc4cc822
SHA1

f28c648505b49055af0da7cf7e83212a32328ff3
SHA256

abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07
SHA512

d034ece8a131b0d6fb3b8780203abf41ec974cfb39d33d9d275ee6114253bafb84b9c3d304f1c9cb7aabca6e7a38e1a9a35728ade73d42f31ff2dba4fbff3034
SSDEEP

3072:4L70TJ07S6KNMX+EOrdznF6C4Ds0XTqNEAOisQ070pl5pK7A:XtlpUKbE5isQ07J8

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4332-132-0x0000000002A70000-0x0000000003A9A000-memory.dmp	upx
behavioral2/memory/4332-136-0x0000000002A70000-0x0000000003A9A000-memory.dmp	upx
behavioral2/memory/4332-137-0x0000000002A70000-0x0000000003A9A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemIL = "c:\\windows\\SYSTEMIL.EXE"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemIL = "c:\\windows\\SYSTEMIL.EXE"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File created	\??\c:\windows\SYSTEMIL.EXE	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File opened for modification	\??\c:\windows\SYSTEMIL.EXE	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File created	C:\windows\Start Menu\Programs\Startup\SYSTEMIL1.EXE	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File created	C:\windows\All Users\Start Menu\Programs\Startup\SYSTEMIL2.EXE	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
File opened for modification	C:\WINDOWS\SYSTEMIL.EXE	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Token: SeDebugPrivilege	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 788	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	8
PID 4332 wrote to memory of 796	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	77
PID 4332 wrote to memory of 396	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	10
PID 4332 wrote to memory of 2444	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	53
PID 4332 wrote to memory of 2452	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	52
PID 4332 wrote to memory of 2704	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	45
PID 4332 wrote to memory of 2824	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	43
PID 4332 wrote to memory of 3120	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	42
PID 4332 wrote to memory of 3320	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	41
PID 4332 wrote to memory of 3408	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	40
PID 4332 wrote to memory of 3476	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	39
PID 4332 wrote to memory of 3572	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	38
PID 4332 wrote to memory of 3720	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	37
PID 4332 wrote to memory of 4624	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	34
PID 4332 wrote to memory of 788	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	8
PID 4332 wrote to memory of 796	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	77
PID 4332 wrote to memory of 396	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	10
PID 4332 wrote to memory of 2444	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	53
PID 4332 wrote to memory of 2452	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	52
PID 4332 wrote to memory of 2704	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	45
PID 4332 wrote to memory of 2824	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	43
PID 4332 wrote to memory of 3120	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	42
PID 4332 wrote to memory of 3320	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	41
PID 4332 wrote to memory of 3408	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	40
PID 4332 wrote to memory of 3476	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	39
PID 4332 wrote to memory of 3572	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	38
PID 4332 wrote to memory of 3720	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	37
PID 4332 wrote to memory of 4624	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	34
PID 4332 wrote to memory of 788	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	8
PID 4332 wrote to memory of 796	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	77
PID 4332 wrote to memory of 396	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	10
PID 4332 wrote to memory of 2444	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	53
PID 4332 wrote to memory of 2452	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	52
PID 4332 wrote to memory of 2704	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	45
PID 4332 wrote to memory of 2824	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	43
PID 4332 wrote to memory of 3120	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	42
PID 4332 wrote to memory of 3320	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	41
PID 4332 wrote to memory of 3408	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	40
PID 4332 wrote to memory of 3476	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	39
PID 4332 wrote to memory of 3572	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	38
PID 4332 wrote to memory of 3720	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	37
PID 4332 wrote to memory of 4624	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	34
PID 4332 wrote to memory of 788	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	8
PID 4332 wrote to memory of 796	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	77
PID 4332 wrote to memory of 396	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	10
PID 4332 wrote to memory of 2444	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	53
PID 4332 wrote to memory of 2452	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	52
PID 4332 wrote to memory of 2704	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	45
PID 4332 wrote to memory of 2824	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	43
PID 4332 wrote to memory of 3120	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	42
PID 4332 wrote to memory of 3320	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	41
PID 4332 wrote to memory of 3408	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	40
PID 4332 wrote to memory of 3476	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	39
PID 4332 wrote to memory of 3572	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	38
PID 4332 wrote to memory of 3720	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	37
PID 4332 wrote to memory of 4624	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	34
PID 4332 wrote to memory of 788	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	8
PID 4332 wrote to memory of 796	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	77
PID 4332 wrote to memory of 396	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	10
PID 4332 wrote to memory of 2444	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	53
PID 4332 wrote to memory of 2452	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	52
PID 4332 wrote to memory of 2704	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	45
PID 4332 wrote to memory of 2824	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	43
PID 4332 wrote to memory of 3120	4332	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe	42

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3720

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3572

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3476

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3408

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3120

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2824
- C:\Users\Admin\AppData\Local\Temp\abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe
  "C:\Users\Admin\AppData\Local\Temp\abc28ef160b08a52bcdd28041e4c561b73672a416382e8d3c82bcdcae5cc1e07.exe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4332
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:4764
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:620

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2452

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2444

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-152-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/620-151-0x0000000000000000-mapping.dmp

Download
memory/3484-149-0x0000000000A90000-0x0000000000AA4000-memory.dmp

Filesize
80KB

Download
memory/3484-148-0x0000000000000000-mapping.dmp

Download
memory/3808-138-0x0000000000000000-mapping.dmp

Download
memory/3808-139-0x0000000000C90000-0x0000000000CA4000-memory.dmp

Filesize
80KB

Download
memory/4332-134-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4332-132-0x0000000002A70000-0x0000000003A9A000-memory.dmp

Filesize
16.2MB

Download
memory/4332-136-0x0000000002A70000-0x0000000003A9A000-memory.dmp

Filesize
16.2MB

Download
memory/4332-137-0x0000000002A70000-0x0000000003A9A000-memory.dmp

Filesize
16.2MB

Download
memory/4332-150-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4764-146-0x0000000000000000-mapping.dmp

Download
memory/4764-147-0x00000000007A0000-0x00000000007B4000-memory.dmp

Filesize
80KB

Download
memory/4820-145-0x0000000000E60000-0x0000000000E74000-memory.dmp

Filesize
80KB

Download
memory/4820-144-0x0000000000000000-mapping.dmp

Download
memory/4844-143-0x00000000009D0000-0x00000000009E4000-memory.dmp

Filesize
80KB

Download
memory/4844-142-0x0000000000000000-mapping.dmp

Download
memory/4888-141-0x0000000000A50000-0x0000000000A64000-memory.dmp

Filesize
80KB

Download
memory/4888-140-0x0000000000000000-mapping.dmp

Download