2dd56dc2feee6904652c26caa7208820d7e09b5be2c96a52f5ed5258300d5492

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2023 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b007952ecc4a36954e273b3329c04cd0.exe
Size

45KB
MD5

b007952ecc4a36954e273b3329c04cd0
SHA1

fb34726944bb283ae788e9a3e3e3444ca2956e21
SHA256

2dd56dc2feee6904652c26caa7208820d7e09b5be2c96a52f5ed5258300d5492
SHA512

96c606b78ca838d4b8de7fb82df4a9c4c318ab31225e5adecfe513332a033cc831bcca5d42b854ca986f6669c44e08f2b3cd1782c1c29ba254576071aade9bcb
SSDEEP

768:ESxam3Usjr3Rf1aqStAjjydOunvvUCxoZ9xMcnbcuyD7UVOQI5nox:ERsjdf1aM67v32Z9x5nouy8VTx

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	b007952ecc4a36954e273b3329c04cd0.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	b007952ecc4a36954e273b3329c04cd0.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b007952ecc4a36954e273b3329c04cd0.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	b007952ecc4a36954e273b3329c04cd0.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 14 IoCs

pid	Process
4476	xk.exe
4844	IExplorer.exe
3148	WINLOGON.EXE
1240	CSRSS.EXE
3096	SERVICES.EXE
3460	xk.exe
2904	IExplorer.exe
1940	WINLOGON.EXE
2544	CSRSS.EXE
4068	SERVICES.EXE
4764	LSASS.EXE
2140	SMSS.EXE
3232	LSASS.EXE
4052	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3484-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e5c-8.dat	upx
behavioral2/files/0x0006000000022e60-106.dat	upx
behavioral2/files/0x0006000000022e60-107.dat	upx
behavioral2/memory/4476-110-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4844-114-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e64-113.dat	upx
behavioral2/files/0x0006000000022e64-112.dat	upx
behavioral2/memory/4844-117-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e66-120.dat	upx
behavioral2/files/0x0006000000022e66-119.dat	upx
behavioral2/memory/3148-123-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e67-125.dat	upx
behavioral2/files/0x0006000000022e67-126.dat	upx
behavioral2/files/0x0006000000022e68-132.dat	upx
behavioral2/files/0x0006000000022e68-131.dat	upx
behavioral2/memory/1240-130-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3096-135-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e60-184.dat	upx
behavioral2/memory/3460-185-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3460-188-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e64-190.dat	upx
behavioral2/memory/2904-194-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e66-195.dat	upx
behavioral2/memory/1940-196-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e67-201.dat	upx
behavioral2/memory/1940-199-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e68-206.dat	upx
behavioral2/memory/3484-207-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/2544-205-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4068-210-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e69-212.dat	upx
behavioral2/files/0x0006000000022e69-213.dat	upx
behavioral2/memory/4764-216-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e6a-219.dat	upx
behavioral2/files/0x0006000000022e6a-218.dat	upx
behavioral2/memory/2140-222-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3484-248-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0006000000022e69-250.dat	upx
behavioral2/files/0x0006000000022e6a-253.dat	upx
behavioral2/memory/3232-254-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4052-257-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3484-258-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	b007952ecc4a36954e273b3329c04cd0.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	b007952ecc4a36954e273b3329c04cd0.exe
File created	C:\desktop.ini	b007952ecc4a36954e273b3329c04cd0.exe
File opened for modification	F:\desktop.ini	b007952ecc4a36954e273b3329c04cd0.exe
File created	F:\desktop.ini	b007952ecc4a36954e273b3329c04cd0.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\K:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\O:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\P:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\Q:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\X:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\Z:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\B:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\J:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\M:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\R:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\T:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\V:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\E:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\L:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\I:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\N:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\S:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\U:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\W:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\G:	b007952ecc4a36954e273b3329c04cd0.exe
File opened (read-only)	\??\H:	b007952ecc4a36954e273b3329c04cd0.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	b007952ecc4a36954e273b3329c04cd0.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	b007952ecc4a36954e273b3329c04cd0.exe
File created	C:\Windows\SysWOW64\shell.exe	b007952ecc4a36954e273b3329c04cd0.exe
File created	C:\Windows\SysWOW64\Mig2.scr	b007952ecc4a36954e273b3329c04cd0.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	b007952ecc4a36954e273b3329c04cd0.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	b007952ecc4a36954e273b3329c04cd0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	b007952ecc4a36954e273b3329c04cd0.exe
File created	C:\Windows\xk.exe	b007952ecc4a36954e273b3329c04cd0.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\Desktop\	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	b007952ecc4a36954e273b3329c04cd0.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	b007952ecc4a36954e273b3329c04cd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b007952ecc4a36954e273b3329c04cd0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3484	b007952ecc4a36954e273b3329c04cd0.exe
3484	b007952ecc4a36954e273b3329c04cd0.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3484	b007952ecc4a36954e273b3329c04cd0.exe
4476	xk.exe
4844	IExplorer.exe
3148	WINLOGON.EXE
1240	CSRSS.EXE
3096	SERVICES.EXE
3460	xk.exe
2904	IExplorer.exe
1940	WINLOGON.EXE
2544	CSRSS.EXE
4068	SERVICES.EXE
4764	LSASS.EXE
2140	SMSS.EXE
3232	LSASS.EXE
4052	SMSS.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4476	3484	b007952ecc4a36954e273b3329c04cd0.exe	86
PID 3484 wrote to memory of 4476	3484	b007952ecc4a36954e273b3329c04cd0.exe	86
PID 3484 wrote to memory of 4476	3484	b007952ecc4a36954e273b3329c04cd0.exe	86
PID 3484 wrote to memory of 4844	3484	b007952ecc4a36954e273b3329c04cd0.exe	87
PID 3484 wrote to memory of 4844	3484	b007952ecc4a36954e273b3329c04cd0.exe	87
PID 3484 wrote to memory of 4844	3484	b007952ecc4a36954e273b3329c04cd0.exe	87
PID 3484 wrote to memory of 3148	3484	b007952ecc4a36954e273b3329c04cd0.exe	88
PID 3484 wrote to memory of 3148	3484	b007952ecc4a36954e273b3329c04cd0.exe	88
PID 3484 wrote to memory of 3148	3484	b007952ecc4a36954e273b3329c04cd0.exe	88
PID 3484 wrote to memory of 1240	3484	b007952ecc4a36954e273b3329c04cd0.exe	89
PID 3484 wrote to memory of 1240	3484	b007952ecc4a36954e273b3329c04cd0.exe	89
PID 3484 wrote to memory of 1240	3484	b007952ecc4a36954e273b3329c04cd0.exe	89
PID 3484 wrote to memory of 3096	3484	b007952ecc4a36954e273b3329c04cd0.exe	90
PID 3484 wrote to memory of 3096	3484	b007952ecc4a36954e273b3329c04cd0.exe	90
PID 3484 wrote to memory of 3096	3484	b007952ecc4a36954e273b3329c04cd0.exe	90
PID 3484 wrote to memory of 3460	3484	b007952ecc4a36954e273b3329c04cd0.exe	91
PID 3484 wrote to memory of 3460	3484	b007952ecc4a36954e273b3329c04cd0.exe	91
PID 3484 wrote to memory of 3460	3484	b007952ecc4a36954e273b3329c04cd0.exe	91
PID 3484 wrote to memory of 2904	3484	b007952ecc4a36954e273b3329c04cd0.exe	92
PID 3484 wrote to memory of 2904	3484	b007952ecc4a36954e273b3329c04cd0.exe	92
PID 3484 wrote to memory of 2904	3484	b007952ecc4a36954e273b3329c04cd0.exe	92
PID 3484 wrote to memory of 1940	3484	b007952ecc4a36954e273b3329c04cd0.exe	93
PID 3484 wrote to memory of 1940	3484	b007952ecc4a36954e273b3329c04cd0.exe	93
PID 3484 wrote to memory of 1940	3484	b007952ecc4a36954e273b3329c04cd0.exe	93
PID 3484 wrote to memory of 2544	3484	b007952ecc4a36954e273b3329c04cd0.exe	94
PID 3484 wrote to memory of 2544	3484	b007952ecc4a36954e273b3329c04cd0.exe	94
PID 3484 wrote to memory of 2544	3484	b007952ecc4a36954e273b3329c04cd0.exe	94
PID 3484 wrote to memory of 4068	3484	b007952ecc4a36954e273b3329c04cd0.exe	95
PID 3484 wrote to memory of 4068	3484	b007952ecc4a36954e273b3329c04cd0.exe	95
PID 3484 wrote to memory of 4068	3484	b007952ecc4a36954e273b3329c04cd0.exe	95
PID 3484 wrote to memory of 4764	3484	b007952ecc4a36954e273b3329c04cd0.exe	96
PID 3484 wrote to memory of 4764	3484	b007952ecc4a36954e273b3329c04cd0.exe	96
PID 3484 wrote to memory of 4764	3484	b007952ecc4a36954e273b3329c04cd0.exe	96
PID 3484 wrote to memory of 2140	3484	b007952ecc4a36954e273b3329c04cd0.exe	97
PID 3484 wrote to memory of 2140	3484	b007952ecc4a36954e273b3329c04cd0.exe	97
PID 3484 wrote to memory of 2140	3484	b007952ecc4a36954e273b3329c04cd0.exe	97
PID 3484 wrote to memory of 3232	3484	b007952ecc4a36954e273b3329c04cd0.exe	105
PID 3484 wrote to memory of 3232	3484	b007952ecc4a36954e273b3329c04cd0.exe	105
PID 3484 wrote to memory of 3232	3484	b007952ecc4a36954e273b3329c04cd0.exe	105
PID 3484 wrote to memory of 4052	3484	b007952ecc4a36954e273b3329c04cd0.exe	106
PID 3484 wrote to memory of 4052	3484	b007952ecc4a36954e273b3329c04cd0.exe	106
PID 3484 wrote to memory of 4052	3484	b007952ecc4a36954e273b3329c04cd0.exe	106

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	b007952ecc4a36954e273b3329c04cd0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	b007952ecc4a36954e273b3329c04cd0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	b007952ecc4a36954e273b3329c04cd0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	b007952ecc4a36954e273b3329c04cd0.exe

C:\Users\Admin\AppData\Local\Temp\b007952ecc4a36954e273b3329c04cd0.exe
"C:\Users\Admin\AppData\Local\Temp\b007952ecc4a36954e273b3329c04cd0.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3484
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4476
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4844
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3148
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1240
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3096
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3460
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2904
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1940
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2544
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4068
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4764
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2140
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3232
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
45KB

MD5
1391549e3137aa8e8468cd2f2e408263

SHA1
c1b1a640c884d9fe1d2ec2e1b198d4f2b0fb6670

SHA256
c3b08e581160d2378374c490a10f9ee5945c0c35c0ae6e3ad2efac192db7d302

SHA512
41d401ae4b4bd3c3cfb0aa22259bbf9035c6d392bd85cd680b8e6277f1ba0ac1c7b3911cfb2226e420d9004bdaabed80d0dcf3fbbfbdf99a988c9df2c3367461

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
45KB

MD5
ef2a1b6eecfed1b1637a6caef80df6a8

SHA1
8a4bfd02ea24aa3eb48135947db64a771995e269

SHA256
0865ce476322f532771d1bd91b3cfbba83e226c98fca30120e1a16c1e6056f37

SHA512
74296f55111f815c0d502f8434c4a170f2c4a827b782e2e08eb9177167586ab0c395c6f6a904cb84e8604e441b979059a6a8293c0bffa68908aa8eedbe2589c5

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
45KB

MD5
571d107759acb5ca9e5bf089439b71bd

SHA1
925e0dec38208c358718edd0e663de2c9e61b77e

SHA256
b10e11609141757ae94f0a01c848ced002ab84ab99c7c12abe535a6de04f22a8

SHA512
3b9a56ae81ce4a6f17f279fd91a8872f9be202d6f520deadbf59c7634cc63b28523679ac1dc943f419b4cdb46554ddaf58b07205bfb989161e802b46e5ba39c1

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
45KB

MD5
571d107759acb5ca9e5bf089439b71bd

SHA1
925e0dec38208c358718edd0e663de2c9e61b77e

SHA256
b10e11609141757ae94f0a01c848ced002ab84ab99c7c12abe535a6de04f22a8

SHA512
3b9a56ae81ce4a6f17f279fd91a8872f9be202d6f520deadbf59c7634cc63b28523679ac1dc943f419b4cdb46554ddaf58b07205bfb989161e802b46e5ba39c1

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
45KB

MD5
417f87bdf68185074700f87c4aa9a6dc

SHA1
759ba7d3ff16f1746e707a2bfa0a2e5a9686fea8

SHA256
88480772e844adeb1cd28cba1d83714de4aa35e2a032f9df4456419fe7c5d5d3

SHA512
65d1f768d70e9191befd1e79674656ae34b6575b057a932e5748e730bf49f26eb126ce96eb11538718ce32ef23a91dd80ecb6dd954e2f33821e3308df91ee15b

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
45KB

MD5
02afa4b1b2f9fcf7e3b6ec213df95f7c

SHA1
04c39a950bded1b5d8f46e7176a415c6f004c21b

SHA256
edded09b7b258259d89ea816ef3e31fd2321e1469d025c840d13b0dfb101db53

SHA512
5d8f9b11039eb0cb449a1970c9a894e27849590001d94787c3408d6902adb02d9eda76e05235498f43c8bd27420f3c4c0553537807e564a8f44ea8fe0a420a13

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
45KB

MD5
05b5b730eb0da2c39ef12a471029242c

SHA1
d72b5010b213c304af214c0944879aa15d7ef223

SHA256
89e146fa4803a6bfb26ac1174aa5463db4102d8281d64372739ed651ad76a5b6

SHA512
5ce87390bdd883908792c6493cde0b6b45653ca31572371b8efef7372f4f2866dd57b56120ee39bb5d84418070d82d4657fc8220b1dd2bd91d2fdbda92eb02e5

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
45KB

MD5
05b5b730eb0da2c39ef12a471029242c

SHA1
d72b5010b213c304af214c0944879aa15d7ef223

SHA256
89e146fa4803a6bfb26ac1174aa5463db4102d8281d64372739ed651ad76a5b6

SHA512
5ce87390bdd883908792c6493cde0b6b45653ca31572371b8efef7372f4f2866dd57b56120ee39bb5d84418070d82d4657fc8220b1dd2bd91d2fdbda92eb02e5

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
45KB

MD5
c144e0f33038cea17d42eb982856e64e

SHA1
6035ef0b6166ab658d8bfbf9f2b01a976175ca9e

SHA256
a2a862c2da9b9fa4b473e03f153633bda27f12f7a3fe447c957b7db5890e730a

SHA512
43d3a8810e2e3f71ab9343cd2a4f5fb1ed7c8d4df1fe118f079c4c8cd5d6db32c8d7eb25969659ebb9b4574d4eab7ac80c536ea759b5a79d419c3f275c285459

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
45KB

MD5
cc6237f97eb69955d7221dedecedd1e6

SHA1
15ac158a65350405a15caa62831b4fbda990a22b

SHA256
66cb2f0f0aabd40a01cdb09eac4a3246eadbef885129380237f328f2993863cf

SHA512
e488a10cb12b18ff42e5a6b81c01acb682eae214e0537b0fc3f029945774e862130af79c5d1474feee3f439815e10412c94cf656413ec30f8ab59a30e4436feb

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
45KB

MD5
b007952ecc4a36954e273b3329c04cd0

SHA1
fb34726944bb283ae788e9a3e3e3444ca2956e21

SHA256
2dd56dc2feee6904652c26caa7208820d7e09b5be2c96a52f5ed5258300d5492

SHA512
96c606b78ca838d4b8de7fb82df4a9c4c318ab31225e5adecfe513332a033cc831bcca5d42b854ca986f6669c44e08f2b3cd1782c1c29ba254576071aade9bcb

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
45KB

MD5
1391549e3137aa8e8468cd2f2e408263

SHA1
c1b1a640c884d9fe1d2ec2e1b198d4f2b0fb6670

SHA256
c3b08e581160d2378374c490a10f9ee5945c0c35c0ae6e3ad2efac192db7d302

SHA512
41d401ae4b4bd3c3cfb0aa22259bbf9035c6d392bd85cd680b8e6277f1ba0ac1c7b3911cfb2226e420d9004bdaabed80d0dcf3fbbfbdf99a988c9df2c3367461

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
45KB

MD5
571d107759acb5ca9e5bf089439b71bd

SHA1
925e0dec38208c358718edd0e663de2c9e61b77e

SHA256
b10e11609141757ae94f0a01c848ced002ab84ab99c7c12abe535a6de04f22a8

SHA512
3b9a56ae81ce4a6f17f279fd91a8872f9be202d6f520deadbf59c7634cc63b28523679ac1dc943f419b4cdb46554ddaf58b07205bfb989161e802b46e5ba39c1

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
45KB

MD5
417f87bdf68185074700f87c4aa9a6dc

SHA1
759ba7d3ff16f1746e707a2bfa0a2e5a9686fea8

SHA256
88480772e844adeb1cd28cba1d83714de4aa35e2a032f9df4456419fe7c5d5d3

SHA512
65d1f768d70e9191befd1e79674656ae34b6575b057a932e5748e730bf49f26eb126ce96eb11538718ce32ef23a91dd80ecb6dd954e2f33821e3308df91ee15b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
45KB

MD5
05b5b730eb0da2c39ef12a471029242c

SHA1
d72b5010b213c304af214c0944879aa15d7ef223

SHA256
89e146fa4803a6bfb26ac1174aa5463db4102d8281d64372739ed651ad76a5b6

SHA512
5ce87390bdd883908792c6493cde0b6b45653ca31572371b8efef7372f4f2866dd57b56120ee39bb5d84418070d82d4657fc8220b1dd2bd91d2fdbda92eb02e5

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
45KB

MD5
c144e0f33038cea17d42eb982856e64e

SHA1
6035ef0b6166ab658d8bfbf9f2b01a976175ca9e

SHA256
a2a862c2da9b9fa4b473e03f153633bda27f12f7a3fe447c957b7db5890e730a

SHA512
43d3a8810e2e3f71ab9343cd2a4f5fb1ed7c8d4df1fe118f079c4c8cd5d6db32c8d7eb25969659ebb9b4574d4eab7ac80c536ea759b5a79d419c3f275c285459

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
d876d4645b5a2f1a6ed275545e0bb4dd

SHA1
3472dcf5d6ef26d5d6ceb165ba76fbfec6cc3b19

SHA256
f1842669297d0eca6e38917a2efd7d127ba059ff88a00231e8791b39d9ce3c82

SHA512
8229abcdf1d31feb16ebb2ea89fd166aeba8eca6630a8f9827dfcdd46953f4c95a13eb57685f946d1e2fb5a273c10c63bfec148e58d67cfc66c00d537f90b669

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
d876d4645b5a2f1a6ed275545e0bb4dd

SHA1
3472dcf5d6ef26d5d6ceb165ba76fbfec6cc3b19

SHA256
f1842669297d0eca6e38917a2efd7d127ba059ff88a00231e8791b39d9ce3c82

SHA512
8229abcdf1d31feb16ebb2ea89fd166aeba8eca6630a8f9827dfcdd46953f4c95a13eb57685f946d1e2fb5a273c10c63bfec148e58d67cfc66c00d537f90b669

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
1c982cd94f215ddb0e17e8e674388a76

SHA1
bddd357b7688e8156d8ea41260f356d8c43fdfa3

SHA256
bcd0e7d7065173ecbdbca74a7f591396a11d8fd68f67d14a7ba93fca5c0b5396

SHA512
2001455979f2025c2600cfecb14da36d43c595210cc775d201473219f8428a76b9b0f58f81d2b2824e7a800f2fde2dd58a32d0a56ddc40622fa0abe22661884a

Download Submit
C:\Windows\xk.exe

Filesize
45KB

MD5
c5ad689b521c38f7a0082c68806d8519

SHA1
7350b49df432c455f07b675e28941dc0140bcdaa

SHA256
60df0871ec08f4db74c2a55a961fd64eb81cc0c4f2eee5a12b8b5c99ce8b659a

SHA512
da99944217b2b3779c99d8ba3b636f8e89204be6c36f20abeffe57c0f296be2862e62701d7bd5322373834ce1d4e7523278ea283c059c2d2cd7647578cba2cd6

Download Submit
C:\Windows\xk.exe

Filesize
45KB

MD5
c5ad689b521c38f7a0082c68806d8519

SHA1
7350b49df432c455f07b675e28941dc0140bcdaa

SHA256
60df0871ec08f4db74c2a55a961fd64eb81cc0c4f2eee5a12b8b5c99ce8b659a

SHA512
da99944217b2b3779c99d8ba3b636f8e89204be6c36f20abeffe57c0f296be2862e62701d7bd5322373834ce1d4e7523278ea283c059c2d2cd7647578cba2cd6

Download Submit
C:\Windows\xk.exe

Filesize
45KB

MD5
4471277f4a427bfe4f3962f37edfffca

SHA1
6fe3946ec957cb89e5d7902ee9a6d5f32b4f6487

SHA256
02656f4734d7e5a94ed8264d29969844527b91be977d46ad6df4baca7706a737

SHA512
f9d4eea6f033c71c52feb3328c3fef3ada13e0ab5b681b59a073420fe8c4461cbcc07263946199d17a2afb1e4e58c0b44bd7113421417671a5e15236df8189a7

Download Submit
memory/1240-130-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1940-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1940-196-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2140-222-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2544-205-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2904-194-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3096-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3148-123-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3232-254-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3460-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3460-185-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3484-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3484-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3484-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3484-258-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4052-257-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4068-210-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4476-110-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4764-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4844-117-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4844-114-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download