Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 11:01
Behavioral task
behavioral1
Sample
0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe
Resource
win7-20240220-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe
-
Size
91KB
-
MD5
b8c4367c2557b90f97ea8f8ccecbf362
-
SHA1
6e37771a2a4f04856a491596108c324f660d9103
-
SHA256
0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691
-
SHA512
f5cea416ab9f1216a4dd438cb3ca6b8b200fb6a78c1ad5a1316c9ab669824dcb85c95c1ba49aa86b90cecbe7ed96b74fedc315bc034e3ccbb103f712a2eec06e
-
SSDEEP
1536:Si9nYGoQzoqZulWd3bGMSp7w+gRwySkO172w+0DQag:/YGoQzoTYd3bGMSReVSzxx+0DE
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ghost.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfserver.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logogo.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Discovery.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravcopy.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zjb.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernelwind32.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atpup.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wsyscheck.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TxoMoU.Exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zhudongfangyu.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arswp2.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guangd.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SelfUpdate.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FYFireWall.exe explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe\Debugger = "ntsd -d" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe\Debugger = "ntsd -d" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe explorer.exe -
Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TSPS.lnk explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1681.lnk explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8970.lnk explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 2020 explorer.exe -
Loads dropped DLL 3 IoCs
pid Process 2784 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe 2784 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe 2020 explorer.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" explorer.exe -
resource yara_rule behavioral1/memory/2784-0-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/files/0x000c000000012253-7.dat upx behavioral1/memory/2020-10-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2784-26-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-38-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-43-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-46-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-50-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-53-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-56-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-59-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-63-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-66-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-69-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-72-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-76-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-79-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2020-82-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\k: explorer.exe File opened (read-only) \??\n: explorer.exe File opened (read-only) \??\p: explorer.exe File opened (read-only) \??\s: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\p: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\v: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\s: explorer.exe File opened (read-only) \??\m: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\e: explorer.exe File opened (read-only) \??\t: explorer.exe File opened (read-only) \??\z: explorer.exe File opened (read-only) \??\q: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\k: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\l: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\m: explorer.exe File opened (read-only) \??\o: explorer.exe File opened (read-only) \??\v: explorer.exe File opened (read-only) \??\e: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\u: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\l: explorer.exe File opened (read-only) \??\x: explorer.exe File opened (read-only) \??\y: explorer.exe File opened (read-only) \??\r: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\i: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\n: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\t: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\g: explorer.exe File opened (read-only) \??\i: explorer.exe File opened (read-only) \??\w: explorer.exe File opened (read-only) \??\g: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\h: explorer.exe File opened (read-only) \??\j: explorer.exe File opened (read-only) \??\r: explorer.exe File opened (read-only) \??\h: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\o: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\x: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\y: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\z: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened (read-only) \??\q: explorer.exe File opened (read-only) \??\u: explorer.exe File opened (read-only) \??\j: 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files explorer.exe File opened for modification C:\Program Files (x86)\ explorer.exe File opened for modification C:\Program Files (x86)\Kaspersky Lab explorer.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe File opened for modification C:\Program Files (x86)\Common Files\ips888.dll explorer.exe File created C:\Program Files (x86)\Common Files\ips888.dll explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" explorer.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 2784 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe 2020 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeLoadDriverPrivilege 2784 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe Token: SeLoadDriverPrivilege 2020 explorer.exe Token: SeDebugPrivilege 2020 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2020 explorer.exe 2020 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2020 2784 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe 28 PID 2784 wrote to memory of 2020 2784 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe 28 PID 2784 wrote to memory of 2020 2784 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe 28 PID 2784 wrote to memory of 2020 2784 0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe 28 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe"C:\Users\Admin\AppData\Local\Temp\0b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5b8c4367c2557b90f97ea8f8ccecbf362
SHA16e37771a2a4f04856a491596108c324f660d9103
SHA2560b71eedde8ebaddc339a90858324dea4ff468cdd636955ba2e3f5c5742424691
SHA512f5cea416ab9f1216a4dd438cb3ca6b8b200fb6a78c1ad5a1316c9ab669824dcb85c95c1ba49aa86b90cecbe7ed96b74fedc315bc034e3ccbb103f712a2eec06e
-
Filesize
491B
MD5d38e2cf2c1665d1a9c34c52ec3670e9b
SHA1ae6e62f8c614571ee26947e2d6a9e1286ca0e422
SHA25628d22e43670eb6c1312895d4d68e3a56d80490a34154cdc39e2aae7a9e9114d9
SHA5120bf0d849473b5315e48112a25dd1443cc261d1722f294e5bbe8b179b590870b8a7942b60650627cae902efd12517f07bae03c38e005e438c4167648b0bdef3f5
-
Filesize
17KB
MD552ed87e5be3f265816b4ecadc24f2c1a
SHA1ed8165a7175bd45b0cb42c5fcffd0bcd502bc07c
SHA256b900c5dc3e36cd246bd11e754c29725ac99c4457cd3a9e6b32c4b3d7db7b53d6
SHA512462c23917e901474149ad7ace20e16136fb02c712dad7c4134fc1ea2d33789b3459dcac8ca08da3347e1f92ab14f211e5b6bc99d4c0e625ba59768d7c40d70e3