034fb9dbc4e2fc22b196f423ce029d04aef18ffa82c1846f1fccab5e2ff49323

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,sys.exe"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe shell.exe"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blank = "C:\\Windows\\system32\\blank.htm"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vxds = "C:\\Windows\\vxds.exe"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hlps = "C:\\Windows\\Help\\hlps.exe"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\blank = "C:\\Windows\\system32\\blank.htm"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LogonPrompt = "[Day of judgment]"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Welcome = "[Antichrist]"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "[Antichrist]"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "[Day of judgment]"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	C:\autorun.inf	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File opened for modification	F:\autorun.inf	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	F:\autorun.inf	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\blank.htm	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File opened for modification	C:\Windows\SysWOW64\sys.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	C:\Windows\SysWOW64\sys.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File opened for modification	C:\Windows\SysWOW64\OEMLOGO.BMP	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	C:\Windows\SysWOW64\OEMLOGO.BMP	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File opened for modification	C:\Windows\SysWOW64\OEMINFO.INI	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	C:\Windows\SysWOW64\OEMINFO.INI	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File opened for modification	C:\Windows\SysWOW64\blank.htm	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\media\wma.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	C:\Windows\media\wma.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File opened for modification	C:\Windows\shell.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	C:\Windows\shell.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File opened for modification	C:\Windows\vxds.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	C:\Windows\vxds.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File opened for modification	C:\Windows\Help\hlps.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe
File created	C:\Windows\Help\hlps.exe	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "C:\\Windows\\system32\\blank.htm"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer [Day of judgment]"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "C:\\Windows\\system32\\blank.htm"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Colors	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Colors\Background = "155 255 155"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveAutoRun = "0"	51ec6784a1c6d03d7aaf1872a55cee1b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "149"	51ec6784a1c6d03d7aaf1872a55cee1b.exe

C:\Users\Admin\AppData\Local\Temp\51ec6784a1c6d03d7aaf1872a55cee1b.exe
"C:\Users\Admin\AppData\Local\Temp\51ec6784a1c6d03d7aaf1872a55cee1b.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies data under HKEY_USERS
- System policy modification
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

2

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

2

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media