Analysis
-
max time kernel
180s -
max time network
202s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
14-11-2023 19:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe
Resource
win7-20231023-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe
-
Size
3.2MB
-
MD5
0743446261cd62ae7d2045f0afe83720
-
SHA1
445af0099c6c494da6d901fd5d0ef11d5a9d2fdd
-
SHA256
6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba
-
SHA512
b790d765eb5257302854ec3d1be5a5c6080d550a8a0c3980cdf96a18b1496b6512e191b212b73bd318d009b25bb8032ee4bbe1f0bf47560c48b61971c56a52d2
-
SSDEEP
6144:n3ue8ySm8hQAAIfFrRXuEE+0l97mKwKUoqHVbV86JQPDHDdx/Qtqa:V/zkFF+EExZmKbUouV5PJQPDHvd
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xehqt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe -
Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "umauibqcxpramqcl.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iewumjcsrntgweuhfkgy.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "vqhevrjywrwixetfcgb.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bujetndqmfisfkxhc.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "iewumjcsrntgweuhfkgy.exe" xehqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keuqgbsgdxbmagufbe.exe" xehqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "iewumjcsrntgweuhfkgy.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "keuqgbsgdxbmagufbe.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "vqhevrjywrwixetfcgb.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "xunmfdxoolsgxgxlkqngf.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "xunmfdxoolsgxgxlkqngf.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bujetndqmfisfkxhc.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "bujetndqmfisfkxhc.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunmfdxoolsgxgxlkqngf.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keuqgbsgdxbmagufbe.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunmfdxoolsgxgxlkqngf.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iewumjcsrntgweuhfkgy.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kuamsdko = "umauibqcxpramqcl.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xehqt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iewumjcsrntgweuhfkgy.exe" xehqt.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xehqt.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xehqt.exe -
Executes dropped EXE 2 IoCs
pid Process 2660 xehqt.exe 2436 xehqt.exe -
Loads dropped DLL 4 IoCs
pid Process 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "iewumjcsrntgweuhfkgy.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "umauibqcxpramqcl.exe ." 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "iewumjcsrntgweuhfkgy.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\makakzksjxva = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqueir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "umauibqcxpramqcl.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\bmtgnzhma = "keuqgbsgdxbmagufbe.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "bujetndqmfisfkxhc.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\bmtgnzhma = "bujetndqmfisfkxhc.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "keuqgbsgdxbmagufbe.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqueir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "umauibqcxpramqcl.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\bmtgnzhma = "bujetndqmfisfkxhc.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keuqgbsgdxbmagufbe.exe ." 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "iewumjcsrntgweuhfkgy.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "keuqgbsgdxbmagufbe.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "umauibqcxpramqcl.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\makakzksjxva = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunmfdxoolsgxgxlkqngf.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "xunmfdxoolsgxgxlkqngf.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bujetndqmfisfkxhc.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pclajxhoero = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "bujetndqmfisfkxhc.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqueir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pclajxhoero = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "iewumjcsrntgweuhfkgy.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "bujetndqmfisfkxhc.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "xunmfdxoolsgxgxlkqngf.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iewumjcsrntgweuhfkgy.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunmfdxoolsgxgxlkqngf.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\makakzksjxva = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iewumjcsrntgweuhfkgy.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "vqhevrjywrwixetfcgb.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "iewumjcsrntgweuhfkgy.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iewumjcsrntgweuhfkgy.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pclajxhoero = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunmfdxoolsgxgxlkqngf.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\bmtgnzhma = "xunmfdxoolsgxgxlkqngf.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\bmtgnzhma = "iewumjcsrntgweuhfkgy.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "bujetndqmfisfkxhc.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pclajxhoero = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunmfdxoolsgxgxlkqngf.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "vqhevrjywrwixetfcgb.exe ." 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\bmtgnzhma = "iewumjcsrntgweuhfkgy.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "vqhevrjywrwixetfcgb.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqueir = "bujetndqmfisfkxhc.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "umauibqcxpramqcl.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "umauibqcxpramqcl.exe ." 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\makakzksjxva = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keuqgbsgdxbmagufbe.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\bmtgnzhma = "bujetndqmfisfkxhc.exe" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pclajxhoero = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keuqgbsgdxbmagufbe.exe ." 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqueir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunmfdxoolsgxgxlkqngf.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pclajxhoero = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bujetndqmfisfkxhc.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqueir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqueir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keuqgbsgdxbmagufbe.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqhevrjywrwixetfcgb.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\makakzksjxva = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keuqgbsgdxbmagufbe.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "bujetndqmfisfkxhc.exe ." xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bujetndqmfisfkxhc.exe ." 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\makakzksjxva = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe" xehqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ugockxgmbn = "vqhevrjywrwixetfcgb.exe ." xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\makakzksjxva = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iewumjcsrntgweuhfkgy.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pclajxhoero = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umauibqcxpramqcl.exe ." 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqueir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunmfdxoolsgxgxlkqngf.exe" xehqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vejuzjp = "keuqgbsgdxbmagufbe.exe ." xehqt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xehqt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xehqt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xehqt.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 www.showmyipaddress.com 9 whatismyipaddress.com 16 www.showmyipaddress.com 18 whatismyip.everdot.org -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\ouwegnqqzfvsskkhpekmuwdggp.lii xehqt.exe File opened for modification C:\Windows\SysWOW64\pgtmzrfqkbckvyjrkkbohumalfwxfqtemffwj.phv xehqt.exe File created C:\Windows\SysWOW64\pgtmzrfqkbckvyjrkkbohumalfwxfqtemffwj.phv xehqt.exe File opened for modification C:\Windows\SysWOW64\ouwegnqqzfvsskkhpekmuwdggp.lii xehqt.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ouwegnqqzfvsskkhpekmuwdggp.lii xehqt.exe File created C:\Program Files (x86)\ouwegnqqzfvsskkhpekmuwdggp.lii xehqt.exe File opened for modification C:\Program Files (x86)\pgtmzrfqkbckvyjrkkbohumalfwxfqtemffwj.phv xehqt.exe File created C:\Program Files (x86)\pgtmzrfqkbckvyjrkkbohumalfwxfqtemffwj.phv xehqt.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\ouwegnqqzfvsskkhpekmuwdggp.lii xehqt.exe File created C:\Windows\ouwegnqqzfvsskkhpekmuwdggp.lii xehqt.exe File opened for modification C:\Windows\pgtmzrfqkbckvyjrkkbohumalfwxfqtemffwj.phv xehqt.exe File created C:\Windows\pgtmzrfqkbckvyjrkkbohumalfwxfqtemffwj.phv xehqt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe 2660 xehqt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2660 xehqt.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2660 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 29 PID 2656 wrote to memory of 2660 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 29 PID 2656 wrote to memory of 2660 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 29 PID 2656 wrote to memory of 2660 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 29 PID 2656 wrote to memory of 2436 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 30 PID 2656 wrote to memory of 2436 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 30 PID 2656 wrote to memory of 2436 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 30 PID 2656 wrote to memory of 2436 2656 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe 30 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xehqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xehqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xehqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xehqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe"C:\Users\Admin\AppData\Local\Temp\6bda5cd4ccf9dba7993a9a10c5f607a2a6cdca3f5d91c6a7017e117ef10cdcba.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\xehqt.exe"C:\Users\Admin\AppData\Local\Temp\xehqt.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\xehqt.exe"C:\Users\Admin\AppData\Local\Temp\xehqt.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD53b2cd4eeb17a67b7c974daa365ecfb42
SHA15de0fcdd341d65ca4050acb09c6152e013c8b15b
SHA256bc54a34c7118d8d0b29151631736a057408aea99a4732539fbeeeb8fa4938cd0
SHA512847321d0f60ee1ce277369176a09a3f191e15723802cb4056af74ae29a5432670299b1bf5b2920c49c01b16dc780cdedfa3aa5b65919a367e550bbd6eb88c833
-
Filesize
272B
MD52b3283148af3a81ec0622a29547bf747
SHA1a2dcba53fbccaae9a438302e60e4dae492e188c3
SHA256347477200c80da84cb0f7f090a9191ee4978e72d3e2f6d8b63a357a3480afe63
SHA512d582018977bbe65a6547564ce60057993c0c9c8dbb0d931be6f59aff0a90a38d8c629deec417aee2683ba2c8ad4e1c13bf2a1e13d95ba11a01c779a85ff3e3c4
-
Filesize
272B
MD5a49acffbf1fdeb0aa3cbc0a2be49a29b
SHA11c0f813ab8eec5dd7c183ebd2f32a321a17268cd
SHA25627d9b2cc5587b81c5f5d73432b980f7c7f51f8dba6cf4bf05f0fcbd9cd817a83
SHA512e5f78ce6532ca692263335db9ec86794feaa0b3b64f6725055b27824cb14da38fa42e330ec0a4c2ff95b45d8c7915abcd9f18dc3cd4666bd0bc443120eb04e6b
-
Filesize
272B
MD5951ec5dbc6fb97bcf1bd95afff25c877
SHA1c8e1eefde6252af296753f7f88e170ace75cc751
SHA256d33e10f9d5cc28fe292c09a1680e631da32336bfdb8987bc555bdde467ff605d
SHA5128f6aed2263c0c83d319040b40b88ecafa70739af765092543cc26238dffc0922634e8841d2ff995184c43156d01b383d5c4319125b91919c27f5068bb6214783
-
Filesize
272B
MD564702a94e020767b0edd4210460313fa
SHA1a1b3ea45328354ad29b221331e88d615e97f74d8
SHA2565dacee852f313114f6d2ebb39d2014611dfd8d97bbe389a2eaf499eebf16eb0d
SHA512d82f27aba4cc250cf5ffb2ce62b75764a1bbf4750a4bdecbad2e5ec096a1ca3fd125f66335bf367cca1e9f6a9ca4ecc50edd0f113d212c6c3ddc852d847635a9
-
Filesize
4.4MB
MD5601b27c2caa10de3cde8dc8a5350ef88
SHA1916e36cc718531cffd65b30345ae9da4a854d611
SHA2564339a5666446e62212b9b3f6f181fe21c9507d0cc3d00c96e38f29c5dc678718
SHA5127061081f589d014760270ae2ddc6c3d522a6268440306cc6741fae381786fdd0952b5e857869d2da8e1394272459701cb841d497d57dbde97dddffd2d705a6a3
-
Filesize
4.4MB
MD5601b27c2caa10de3cde8dc8a5350ef88
SHA1916e36cc718531cffd65b30345ae9da4a854d611
SHA2564339a5666446e62212b9b3f6f181fe21c9507d0cc3d00c96e38f29c5dc678718
SHA5127061081f589d014760270ae2ddc6c3d522a6268440306cc6741fae381786fdd0952b5e857869d2da8e1394272459701cb841d497d57dbde97dddffd2d705a6a3
-
Filesize
4.4MB
MD5601b27c2caa10de3cde8dc8a5350ef88
SHA1916e36cc718531cffd65b30345ae9da4a854d611
SHA2564339a5666446e62212b9b3f6f181fe21c9507d0cc3d00c96e38f29c5dc678718
SHA5127061081f589d014760270ae2ddc6c3d522a6268440306cc6741fae381786fdd0952b5e857869d2da8e1394272459701cb841d497d57dbde97dddffd2d705a6a3
-
Filesize
272B
MD5a050fca533828b172473356868646959
SHA10200afd8a95340e4d348978dc6e0492f169f6509
SHA25671e61de10118c7ad08665efdebafb44592f4a22b8e7562a44f08ed6a07f9aaa7
SHA5122339b80cfc7995347af71e7ca27fa6b588b27890c6b8554d8230bd165cee22c515f88ecb1faa3b21c3a9e0a08cbfc0be82b6fa045147fa8beab0da1f2deb2392
-
Filesize
3KB
MD556f80f0ec81c3fd1493fd4d1f2465488
SHA11453641315ebe8ea0cb7a4e18568d153668addee
SHA2561c3ad6d81fbfc6cb785b26cf7fec47de2549ffdaf5064cae667e9362dbc3e93d
SHA512e46a9cc915f2c9a153aa7baec8d384ef30760de5a8b72464d9101341af6c839bcb35b27039e7998d8ae423a29ee51858b825044c336ff5c927f81a574d60d273
-
Filesize
4.4MB
MD5601b27c2caa10de3cde8dc8a5350ef88
SHA1916e36cc718531cffd65b30345ae9da4a854d611
SHA2564339a5666446e62212b9b3f6f181fe21c9507d0cc3d00c96e38f29c5dc678718
SHA5127061081f589d014760270ae2ddc6c3d522a6268440306cc6741fae381786fdd0952b5e857869d2da8e1394272459701cb841d497d57dbde97dddffd2d705a6a3
-
Filesize
4.4MB
MD5601b27c2caa10de3cde8dc8a5350ef88
SHA1916e36cc718531cffd65b30345ae9da4a854d611
SHA2564339a5666446e62212b9b3f6f181fe21c9507d0cc3d00c96e38f29c5dc678718
SHA5127061081f589d014760270ae2ddc6c3d522a6268440306cc6741fae381786fdd0952b5e857869d2da8e1394272459701cb841d497d57dbde97dddffd2d705a6a3
-
Filesize
4.4MB
MD5601b27c2caa10de3cde8dc8a5350ef88
SHA1916e36cc718531cffd65b30345ae9da4a854d611
SHA2564339a5666446e62212b9b3f6f181fe21c9507d0cc3d00c96e38f29c5dc678718
SHA5127061081f589d014760270ae2ddc6c3d522a6268440306cc6741fae381786fdd0952b5e857869d2da8e1394272459701cb841d497d57dbde97dddffd2d705a6a3
-
Filesize
4.4MB
MD5601b27c2caa10de3cde8dc8a5350ef88
SHA1916e36cc718531cffd65b30345ae9da4a854d611
SHA2564339a5666446e62212b9b3f6f181fe21c9507d0cc3d00c96e38f29c5dc678718
SHA5127061081f589d014760270ae2ddc6c3d522a6268440306cc6741fae381786fdd0952b5e857869d2da8e1394272459701cb841d497d57dbde97dddffd2d705a6a3