a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b

General

Target

a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Size

80KB
MD5

0565bbdfd5711fc074d783739aa22d0f
SHA1

0c1087e6f367f0fc16dcca3ba024a16dc075e9e8
SHA256

a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b
SHA512

a4edf3b4bfdbabf8acc6cd148fd7cbc9a333221aded5191c22f115c8123080ad3b8c5ce995a86f8604bc41e4b6d6b1d5e14abea11436a9092ee26b53be499c3f
SSDEEP

768:u94OyQzTGfJ5xGXrMdqOivexvqvWm6w9M17I36Fyz8ZQOWmI+VkpVUlk4GYxmzHc:u94xQxrMxiFvWjx1c36geQ5CkBzaQ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, WinSysMk.exe"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe

Disables Task Manager via registry modification
evasion

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinSysMk.exe	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
File opened for modification	C:\Windows\SysWOW64\WinSysMk.exe	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	Explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1540	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1704	1540	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe	84
PID 1540 wrote to memory of 1704	1540	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe	84
PID 1540 wrote to memory of 1704	1540	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe	84

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuNetworkPlaces = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL = "1"	a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe

C:\Users\Admin\AppData\Local\Temp\a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe
"C:\Users\Admin\AppData\Local\Temp\a9ab3c07063b4bd6de21d1df6425d9d9c7ea22921cb6c9796f3e5c7cccb4ba4b.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1540
- C:\Windows\SysWOW64\Explorer.exe
  Explorer.exe
  2⤵
  - Modifies registry class
  PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1540-136-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads