94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8

General

Target

94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe
Size

224KB
MD5

7ab53a6d5393930c749b60d506c1df0d
SHA1

00337b90cee2a0e28b1a104d7de142b0f1ff5105
SHA256

94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8
SHA512

bbfbafc3a19912ac9436f2dcd16361b53f6b04efe684fefedbae9a3bbfb2373d45067e94bfcb404a43776bc1b620b491be720c6d7bc82d863a15670f920cdb97
SSDEEP

1536:a54vpQZgAkFwa9cVcAmKQV/6eiCvd3nEHD17Jkmr2gzQi54v:0s9lT9cWAISI3naJrhzb

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe c:\\windows\\system32\\nukeh.exe"	reg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\nukeh.exe	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe
File opened for modification	\??\c:\windows\SysWOW64\nukeh.exe	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	explorer.exe
File created	\??\c:\windows\transfer.txt	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1456	1900	WerFault.exe	26

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
888	reg.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe
1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe
1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2016	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	27
PID 1900 wrote to memory of 2016	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	27
PID 1900 wrote to memory of 2016	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	27
PID 1900 wrote to memory of 2016	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	27
PID 1900 wrote to memory of 888	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	29
PID 1900 wrote to memory of 888	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	29
PID 1900 wrote to memory of 888	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	29
PID 1900 wrote to memory of 888	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	29
PID 1900 wrote to memory of 1456	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	32
PID 1900 wrote to memory of 1456	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	32
PID 1900 wrote to memory of 1456	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	32
PID 1900 wrote to memory of 1456	1900	94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe	32

C:\Users\Admin\AppData\Local\Temp\94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe
"C:\Users\Admin\AppData\Local\Temp\94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp94c8f24a6f754cbcb1ff06e4144ba7884d34acd37fa57e07e8c84bfc7ba919e8
  2⤵
  PID:2016
- C:\Windows\SysWOW64\reg.exe
  reg add hklm\software\microsoft\windows" "NT\currentversion\winlogon /v Shell /t REG_SZ /d explorer.exe" "c:\windows\system32\nukeh.exe /f
  2⤵
  - Modifies WinLogon for persistence
  - Modifies registry key
  PID:888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 380
  2⤵
  - Program crash
  PID:1456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-62-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/860-63-0x00000000039C0000-0x00000000039D0000-memory.dmp

Filesize
64KB

Download
memory/1900-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1900-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1900-65-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2016-60-0x0000000073FE1000-0x0000000073FE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads