Analysis
- max time kernel
151s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 23:03
Behavioral task
behavioral1
Sample
93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe
Resource
win7-20240220-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe
- Size 1.1MB
- Sample240404-21zreadf42
- SHA256 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c
- MD5 29d044809809aabd82305ce04ac88736
- SHA1 683b89f68681730e2828be556d5c687cc1a4a2bf
- SHA512 a7517d7e12962ee42ff42fb941bc6756238cb9f157e8f14958563fc43f9929db8b3a76fd944d7136e21b5bc85178c76b2ba0e412ceb828a74e5b5e78b735c286
- SSDEEP 12288:Lkt3OB1IWL78Z8L7JQQRfOBkkt3OB9JQQRnOBHIWL7JQQRZOBrOB1IWL7JQQRZOV:4eB1BRWBZeBbROBHDRABqB1DRAB19
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" lsass.exe - Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" service.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" lsass.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" service.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe - UPX dump on OEP (original entry point) 59 IoCs
resource yara_rule behavioral2/memory/1304-0-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/files/0x000700000002321b-16.dat UPX behavioral2/memory/3708-75-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/files/0x0007000000023225-136.dat UPX behavioral2/memory/1304-186-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4392-181-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/files/0x0007000000023225-156.dat UPX behavioral2/files/0x0007000000023225-119.dat UPX behavioral2/memory/4392-365-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-602-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-604-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-605-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-603-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-700-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-701-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-702-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-703-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-704-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-715-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-725-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-727-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-728-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-749-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-750-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-751-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-752-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-860-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-861-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-862-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-863-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1032-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1033-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1035-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1048-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1049-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1051-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1069-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1070-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-1071-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1072-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1081-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1082-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1084-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-1083-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1107-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1108-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1110-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1170-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1171-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1173-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1195-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1196-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1218-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1219-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-1220-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1221-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1247-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1248-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1250-0x0000000000400000-0x000000000042A000-memory.dmp UPX - Disables RegEdit via registry modification 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" service.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsass.exe - Sets file execution options in registry 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe lsass.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe - Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd system.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd smss.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd lsass.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd service.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd winlogon.exe - Executes dropped EXE 5 IoCs
pid Process 2844 service.exe 3708 smss.exe 3976 system.exe 1012 winlogon.exe 4392 lsass.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" lsass.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1304-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000700000002321b-16.dat upx behavioral2/memory/3708-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x0007000000023225-136.dat upx behavioral2/memory/1304-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x0007000000023225-156.dat upx behavioral2/files/0x0007000000023225-119.dat upx behavioral2/memory/4392-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1048-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1072-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-1220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx - Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" lsass.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" service.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" lsass.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: service.exe File opened (read-only) \??\q: winlogon.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\g: system.exe File opened (read-only) \??\o: system.exe File opened (read-only) \??\u: system.exe File opened (read-only) \??\j: service.exe File opened (read-only) \??\h: smss.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\p: system.exe File opened (read-only) \??\x: system.exe File opened (read-only) \??\w: winlogon.exe File opened (read-only) \??\o: service.exe File opened (read-only) \??\p: service.exe File opened (read-only) \??\v: service.exe File opened (read-only) \??\g: winlogon.exe File opened (read-only) \??\p: winlogon.exe File opened (read-only) \??\g: smss.exe File opened (read-only) \??\e: system.exe File opened (read-only) \??\l: system.exe File opened (read-only) \??\k: service.exe File opened (read-only) \??\m: service.exe File opened (read-only) \??\x: winlogon.exe File opened (read-only) \??\w: system.exe File opened (read-only) \??\l: service.exe File opened (read-only) \??\z: service.exe File opened (read-only) \??\j: winlogon.exe File opened (read-only) \??\m: winlogon.exe File opened (read-only) \??\k: smss.exe File opened (read-only) \??\m: smss.exe File opened (read-only) \??\q: smss.exe File opened (read-only) \??\e: service.exe File opened (read-only) \??\q: service.exe File opened (read-only) \??\h: winlogon.exe File opened (read-only) \??\i: winlogon.exe File opened (read-only) \??\r: winlogon.exe File opened (read-only) \??\o: smss.exe File opened (read-only) \??\s: smss.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\i: system.exe File opened (read-only) \??\v: system.exe File opened (read-only) \??\j: smss.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\q: system.exe File opened (read-only) \??\z: system.exe File opened (read-only) \??\l: winlogon.exe File opened (read-only) \??\t: smss.exe File opened (read-only) \??\v: smss.exe File opened (read-only) \??\w: smss.exe File opened (read-only) \??\z: smss.exe File opened (read-only) \??\y: system.exe File opened (read-only) \??\g: service.exe File opened (read-only) \??\o: winlogon.exe File opened (read-only) \??\u: winlogon.exe File opened (read-only) \??\v: winlogon.exe File opened (read-only) \??\h: service.exe File opened (read-only) \??\s: service.exe File opened (read-only) \??\u: service.exe File opened (read-only) \??\x: service.exe File opened (read-only) \??\k: winlogon.exe File opened (read-only) \??\l: smss.exe File opened (read-only) \??\k: system.exe File opened (read-only) \??\s: winlogon.exe File opened (read-only) \??\t: winlogon.exe - Drops file in System32 directory 51 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\crtsys.dll 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\New Folder(2).exe smss.exe File opened for modification C:\Windows\SysWOW64\51334a winlogon.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Data Admin.exe smss.exe File opened for modification C:\Windows\SysWOW64\51334a 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File created C:\Windows\SysWOW64\127387645063l.exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\en-US\en-US.exe smss.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Data Admin.exe smss.exe File opened for modification C:\Windows\SysWOW64\51334a system.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\51334a smss.exe File created C:\Windows\SysWOW64\127387645063l.exe 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File created C:\Windows\SysWOW64\moonlight.scr 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\New Folder(2).exe smss.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr service.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd lsass.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\New Folder.scr smss.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Data Admin.exe smss.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\res\res.exe smss.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\en-US\en-US.exe smss.exe File created C:\Windows\SysWOW64\127387645063l.exe smss.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe system.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd winlogon.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr winlogon.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd system.exe File opened for modification C:\Windows\SysWOW64\51334a lsass.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd smss.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Data Admin.exe smss.exe File created C:\Windows\SysWOW64\127387645063l.exe system.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr lsass.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\New Folder(2).exe smss.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe service.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe winlogon.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\res\res.exe smss.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\New Folder.scr smss.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr system.exe File created C:\Windows\SysWOW64\127387645063l.exe lsass.exe File opened for modification C:\Windows\SysWOW64\51334a service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd service.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr smss.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe smss.exe File created C:\Windows\SysWOW64\51334a\c1273870.cmd 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll winlogon.exe File created C:\Windows\SysWOW64\127387645063l.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll lsass.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe lsass.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\New Folder(2).exe smss.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\zh-Hans.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\WATER.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\it-it.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\sl-sl.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\pt-PT\pt-PT.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\ko.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\Filters.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\dark.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\ar-ae.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\da-dk.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\1033.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\BREEZE.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\SUMIPNTG.exe smss.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DAO.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\ENES.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\Updates\Download\PackageFiles\343B4C13-5C10-435A-9A70-4467BC88265E\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\Microsoft.AnalysisServices.SPClient.Interfaces.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\ro-ro.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\TextConv\TextConv.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\de.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\RICEPAPR.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\1033.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\es-MX\es-MX.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hu-HU\hu-HU.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\10.0.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\fr.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\fr.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\en-us.exe smss.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\da-dk.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\es-es.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\tr-tr.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\lv-LV\lv-LV.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\EXPEDITN.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\16.exe smss.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\es-ES.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OfficeSoftwareProtectionPlatform.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\da-DK\da-DK.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\el-GR\el-GR.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\lv-LV\lv-LV.exe smss.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\tr.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Pipeline.v10.0.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpred.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\de-DE.exe smss.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\de-DE.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\tr-TR\tr-TR.exe smss.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\de.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\FREN.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\en-il.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\en-GB\en-GB.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\sr-Latn-RS.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\es-ES.exe smss.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\6.0.25.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\1033.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\OFFICE16.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\Stationery\Stationery.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\ru.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\1033.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Admin Porn.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\ca-es.exe smss.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\n\n.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\Foto Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\Data Admin.exe smss.exe File opened for modification \??\c:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\Assets\Assets.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\New Folder.scr smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\r\r.exe smss.exe File opened for modification C:\Windows\35838\bb412475l.com 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File created C:\Windows\35838\smss.exe lsass.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\New Folder(2).exe smss.exe File created \??\c:\Windows\SystemResources\Windows.ShellCommon.SharedResources\PRIS\PRIS.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\r\r.exe smss.exe File opened for modification C:\Windows\l755277.exe smss.exe File opened for modification C:\Windows\036450635.exe lsass.exe File opened for modification \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\Admin Porn.exe smss.exe File created C:\Windows\036450635.exe system.exe File created C:\Windows\lsass.exe lsass.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\r\r.exe smss.exe File created C:\Windows\036450635.exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\Admin Porn.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\r\r.exe smss.exe File created \??\c:\Windows\InputMethod\SHARED\Admin Porn.exe smss.exe File created \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\r\r.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\New Folder(2).exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\r\r.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\Admin Porn.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\Foto Admin.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\Data Admin.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll service.exe File created C:\Windows\036450635.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\New Folder(2).exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\r\r.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll system.exe File created C:\Windows\35838\smss.exe system.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\New Folder.scr smss.exe File opened for modification C:\Windows\lsass.exe winlogon.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\Foto Admin.exe smss.exe File created C:\Windows\35838\bb412475l.com service.exe File opened for modification C:\Windows\35838\bb412475l.com service.exe File opened for modification C:\Windows\l755277.exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\New Folder.scr smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\Foto Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\Admin Porn.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\Foto Admin.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\Foto Admin.exe smss.exe File opened for modification \??\c:\Windows\InputMethod\SHARED\Admin Porn.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\r\r.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\r\r.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\Data Admin.exe smss.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile service.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 2844 service.exe 1012 winlogon.exe 3708 smss.exe 3976 system.exe 4392 lsass.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2844 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 89 PID 1304 wrote to memory of 2844 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 89 PID 1304 wrote to memory of 2844 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 89 PID 1304 wrote to memory of 3708 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 90 PID 1304 wrote to memory of 3708 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 90 PID 1304 wrote to memory of 3708 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 90 PID 1304 wrote to memory of 3976 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 91 PID 1304 wrote to memory of 3976 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 91 PID 1304 wrote to memory of 3976 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 91 PID 1304 wrote to memory of 1012 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 92 PID 1304 wrote to memory of 1012 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 92 PID 1304 wrote to memory of 1012 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 92 PID 1304 wrote to memory of 4392 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 93 PID 1304 wrote to memory of 4392 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 93 PID 1304 wrote to memory of 4392 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe"C:\Users\Admin\AppData\Local\Temp\93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\service.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\service.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2844
-
-
C:\Windows\35838\smss.exe"C:\Windows\35838\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3708
-
-
C:\Windows\35838\system.exe"C:\Windows\35838\system.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3976
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\winlogon.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\winlogon.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
C:\Windows\lsass.exe"C:\Windows\lsass.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4392
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd
- Size 448KB
- SHA256 7d4e216dcd0a8bc514e5ec3fb48eab567d7c7b7fc585a176270367974f6ef64d
- MD5 a7f618a9f8e85aaee2b7053671dca94c
- SHA1 63033e5564a8a5d27802e3bffdadbcf7e7ea3a12
- SHA512 fdbb023a0f8d7fb16869cb25f7de469cd54247d9bb371293ec4276ca1dcc926feb89e09e4f807021fbf48dcf5f2bec3b5ab092eb5e805c2071e90c02d95e115c
- SSDEEP 6144:LkaIXTJiVOTO4r84Y8yrjIWZ5wNEZkRZ8NEZkRZ5wNEZk0tQQRkVOTO4r84Ykka+:Lkt3OB1IWL78Z8L7JQQRfOBkktt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd
- Size 64KB
- SHA256 86380e536b3a318d859e3cc57dd8faa2704e5f55522b4173aef2ed625a68987e
- MD5 8e1acdb764fc1c136f3869189fa7d52c
- SHA1 139e98dd38ba33da9282373387a4745d5f255989
- SHA512 e2595493e1b79f1235b002018bbc72b5372ba92160af4bb2319f4f93986bb8ca8d4ab2b1418e82cc04b939fa22084f80614f89ffef91537c39e96a974422aa8d
- SSDEEP 768:e8Etob3hjfHIPDQahIi7IxvUNVP4IXxuW113CEln+2qM99vG5BMCBNgWkdOBS:e8Etob35KB2MNR4IXNjCENLqwM5hkcBS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd
- Size 256KB
- SHA256 24525d36e3ee1547f4e4e8807fc4457fbf71be87ea419f19f4cfc5be35f87065
- MD5 8f5d334a19ecd204e5aa1fd7268d3f4b
- SHA1 2294eb28a22b57e10a4a65b1b60ab85e1b8a85c2
- SHA512 745c8329abb5a5e9c67828fcee3c38e643642fb8b743af6cf4b6dd9acba72b58410e693af1370bd3000e1650ee11c822562cbf48c9d4191ccc2a89d039d21fe2
- SSDEEP 6144:LkaIXTJiVOTO4r84Y8yrjIWZ5wNEZkRZ8NEZkRZ5wg:Lkt3OB1IWL78Z8LB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\service.exe
- Size 1.1MB
- SHA256 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c
- MD5 29d044809809aabd82305ce04ac88736
- SHA1 683b89f68681730e2828be556d5c687cc1a4a2bf
- SHA512 a7517d7e12962ee42ff42fb941bc6756238cb9f157e8f14958563fc43f9929db8b3a76fd944d7136e21b5bc85178c76b2ba0e412ceb828a74e5b5e78b735c286
- SSDEEP 12288:Lkt3OB1IWL78Z8L7JQQRfOBkkt3OB9JQQRnOBHIWL7JQQRZOBrOB1IWL7JQQRZOV:4eB1BRWBZeBbROBHDRABqB1DRAB19
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\MoonLight.txt
- Size 176B
- SHA256 acdcb1f96825ca74387ebe03f2a12291f7678da2cf6092607aea2dab6982cf35
- MD5 56473592d37a13c9098b21cb442e60fd
- SHA1 6f0f49440289a6cef1d93e8c785747a3fb318688
- SHA512 6c635dc4f1ce55b54e39992531b0a4024c213af7fc3ab0f5b2642a932cb2201e7037a60e37c7aad42308ab7a84f0a2c655391935749d76f02ae7c3afd765dd2a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\crtsys.dll
- Size 120B
- SHA256 98a94698e85b53add5406bbebdee6d4e1fab5d50d773ecb0b6b45a2df4692b64
- MD5 a6f39a9b5556ce4c7cfd87677aa74224
- SHA1 d0216d0a0219a85e0cc803496542fef521d125fc
- SHA512 f3469c1e92b46cb023d0708d5de96ffca7665761a0749ff30d059b5e986e347aad98011117587c47ee08c5bb8eb9c8ebd69b4d842057f5f78bd6abfde903b73a
- MD5 SHA1 SHA512
- Path C:\Windows\system\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\msvbvm60.dll
- Size 192KB
- SHA256 e8cd83998a18db42e3e2459ec00e2c0d54223446253030b332591b808a0af91a
- MD5 b1bbb62a1f02341bf14929284d985907
- SHA1 60779a0498d314384b133ce737c39450a38be205
- SHA512 ce73ec9202d8231fd44ad6bb88f30d64be9b99633f5e9a7803ea1db0883047ef26711cea21aa635f80b6b8d9c8477abd91b6190d647c81235c179ce4baf2c374
- SSDEEP 3072:10uLLBEH/55rq6GIcRXa3Ixx/OLIQJaz2lNuxGSmKjqiwfgcCg:1HifXQNq3IxxmZkz2lN8GSmOmgo
- MD5 SHA1 SHA512 SSDEEP