Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 23:03
Behavioral task
behavioral1
Sample
93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe
Resource
win7-20240220-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe
-
Size
1.1MB
-
MD5
29d044809809aabd82305ce04ac88736
-
SHA1
683b89f68681730e2828be556d5c687cc1a4a2bf
-
SHA256
93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c
-
SHA512
a7517d7e12962ee42ff42fb941bc6756238cb9f157e8f14958563fc43f9929db8b3a76fd944d7136e21b5bc85178c76b2ba0e412ceb828a74e5b5e78b735c286
-
SSDEEP
12288:Lkt3OB1IWL78Z8L7JQQRfOBkkt3OB9JQQRnOBHIWL7JQQRZOBrOB1IWL7JQQRZOV:4eB1BRWBZeBbROBHDRABqB1DRAB19
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\63736\\13463736.exe\"" lsass.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" service.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" lsass.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" service.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe -
UPX dump on OEP (original entry point) 59 IoCs
resource yara_rule behavioral2/memory/1304-0-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/files/0x000700000002321b-16.dat UPX behavioral2/memory/3708-75-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/files/0x0007000000023225-136.dat UPX behavioral2/memory/1304-186-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4392-181-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/files/0x0007000000023225-156.dat UPX behavioral2/files/0x0007000000023225-119.dat UPX behavioral2/memory/4392-365-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-602-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-604-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-605-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-603-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-700-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-701-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-702-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-703-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-704-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-715-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-725-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-727-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-728-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-749-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-750-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-751-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-752-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-860-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-861-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-862-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-863-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1032-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1033-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1035-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1048-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1049-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1051-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1069-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1070-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-1071-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1072-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1081-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1082-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1084-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-1083-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1107-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1108-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1110-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1170-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1171-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1173-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1195-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1196-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1218-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1219-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-1220-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1221-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2844-1247-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3708-1248-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1012-1250-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Disables RegEdit via registry modification 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" service.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsass.exe -
Sets file execution options in registry 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe lsass.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd system.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd smss.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd lsass.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd service.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\adodb.cmd winlogon.exe -
Executes dropped EXE 5 IoCs
pid Process 2844 service.exe 3708 smss.exe 3976 system.exe 1012 winlogon.exe 4392 lsass.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" lsass.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1304-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000700000002321b-16.dat upx behavioral2/memory/3708-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x0007000000023225-136.dat upx behavioral2/memory/1304-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x0007000000023225-156.dat upx behavioral2/files/0x0007000000023225-119.dat upx behavioral2/memory/4392-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1048-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1072-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-1220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-1247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-1248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" lsass.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" service.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0736273 = "C:\\Windows\\l755277.exe" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15832770 = "C:\\Windows\\system32\\127387645063l.exe" lsass.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: service.exe File opened (read-only) \??\q: winlogon.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\g: system.exe File opened (read-only) \??\o: system.exe File opened (read-only) \??\u: system.exe File opened (read-only) \??\j: service.exe File opened (read-only) \??\h: smss.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\p: system.exe File opened (read-only) \??\x: system.exe File opened (read-only) \??\w: winlogon.exe File opened (read-only) \??\o: service.exe File opened (read-only) \??\p: service.exe File opened (read-only) \??\v: service.exe File opened (read-only) \??\g: winlogon.exe File opened (read-only) \??\p: winlogon.exe File opened (read-only) \??\g: smss.exe File opened (read-only) \??\e: system.exe File opened (read-only) \??\l: system.exe File opened (read-only) \??\k: service.exe File opened (read-only) \??\m: service.exe File opened (read-only) \??\x: winlogon.exe File opened (read-only) \??\w: system.exe File opened (read-only) \??\l: service.exe File opened (read-only) \??\z: service.exe File opened (read-only) \??\j: winlogon.exe File opened (read-only) \??\m: winlogon.exe File opened (read-only) \??\k: smss.exe File opened (read-only) \??\m: smss.exe File opened (read-only) \??\q: smss.exe File opened (read-only) \??\e: service.exe File opened (read-only) \??\q: service.exe File opened (read-only) \??\h: winlogon.exe File opened (read-only) \??\i: winlogon.exe File opened (read-only) \??\r: winlogon.exe File opened (read-only) \??\o: smss.exe File opened (read-only) \??\s: smss.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\i: system.exe File opened (read-only) \??\v: system.exe File opened (read-only) \??\j: smss.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\q: system.exe File opened (read-only) \??\z: system.exe File opened (read-only) \??\l: winlogon.exe File opened (read-only) \??\t: smss.exe File opened (read-only) \??\v: smss.exe File opened (read-only) \??\w: smss.exe File opened (read-only) \??\z: smss.exe File opened (read-only) \??\y: system.exe File opened (read-only) \??\g: service.exe File opened (read-only) \??\o: winlogon.exe File opened (read-only) \??\u: winlogon.exe File opened (read-only) \??\v: winlogon.exe File opened (read-only) \??\h: service.exe File opened (read-only) \??\s: service.exe File opened (read-only) \??\u: service.exe File opened (read-only) \??\x: service.exe File opened (read-only) \??\k: winlogon.exe File opened (read-only) \??\l: smss.exe File opened (read-only) \??\k: system.exe File opened (read-only) \??\s: winlogon.exe File opened (read-only) \??\t: winlogon.exe -
Drops file in System32 directory 51 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\crtsys.dll 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\New Folder(2).exe smss.exe File opened for modification C:\Windows\SysWOW64\51334a winlogon.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Data Admin.exe smss.exe File opened for modification C:\Windows\SysWOW64\51334a 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File created C:\Windows\SysWOW64\127387645063l.exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\en-US\en-US.exe smss.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Data Admin.exe smss.exe File opened for modification C:\Windows\SysWOW64\51334a system.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\51334a smss.exe File created C:\Windows\SysWOW64\127387645063l.exe 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File created C:\Windows\SysWOW64\moonlight.scr 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\New Folder(2).exe smss.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr service.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd lsass.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\New Folder.scr smss.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Data Admin.exe smss.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\res\res.exe smss.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\en-US\en-US.exe smss.exe File created C:\Windows\SysWOW64\127387645063l.exe smss.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe system.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd winlogon.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr winlogon.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd system.exe File opened for modification C:\Windows\SysWOW64\51334a lsass.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd smss.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Data Admin.exe smss.exe File created C:\Windows\SysWOW64\127387645063l.exe system.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr lsass.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\New Folder(2).exe smss.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe service.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe winlogon.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\res\res.exe smss.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\New Folder.scr smss.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr system.exe File created C:\Windows\SysWOW64\127387645063l.exe lsass.exe File opened for modification C:\Windows\SysWOW64\51334a service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system.exe File opened for modification C:\Windows\SysWOW64\51334a\c1273870.cmd service.exe File opened for modification C:\Windows\SysWOW64\moonlight.scr smss.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe smss.exe File created C:\Windows\SysWOW64\51334a\c1273870.cmd 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll winlogon.exe File created C:\Windows\SysWOW64\127387645063l.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll lsass.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Windows\SysWOW64\127387645063l.exe lsass.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\New Folder(2).exe smss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\zh-Hans.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\WATER.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\it-it.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\sl-sl.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\pt-PT\pt-PT.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\ko.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\Filters.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\dark.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\ar-ae.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\da-dk.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\1033.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\BREEZE.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\SUMIPNTG.exe smss.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DAO.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\ENES.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\Updates\Download\PackageFiles\343B4C13-5C10-435A-9A70-4467BC88265E\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\Microsoft.AnalysisServices.SPClient.Interfaces.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\ro-ro.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\TextConv\TextConv.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\de.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\RICEPAPR.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\1033.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\es-MX\es-MX.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hu-HU\hu-HU.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\10.0.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\fr.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\fr.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\en-us.exe smss.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\da-dk.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\es-es.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\tr-tr.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\lv-LV\lv-LV.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\EXPEDITN.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\16.exe smss.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\es-ES.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OfficeSoftwareProtectionPlatform.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\da-DK\da-DK.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\el-GR\el-GR.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\lv-LV\lv-LV.exe smss.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\tr.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Pipeline.v10.0.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpred.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\de-DE.exe smss.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\de-DE.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\tr-TR\tr-TR.exe smss.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\de.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\FREN.exe smss.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\en-il.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\en-GB\en-GB.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\sr-Latn-RS.exe smss.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\es-ES.exe smss.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\6.0.25.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\1033.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\OFFICE16.exe smss.exe File created \??\c:\Program Files\Common Files\microsoft shared\Stationery\Stationery.exe smss.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\ru.exe smss.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\1033.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Admin Porn.exe smss.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA.exe smss.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\ca-es.exe smss.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\n\n.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\Foto Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\Data Admin.exe smss.exe File opened for modification \??\c:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\Assets\Assets.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\New Folder.scr smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\r\r.exe smss.exe File opened for modification C:\Windows\35838\bb412475l.com 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File created C:\Windows\35838\smss.exe lsass.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\New Folder(2).exe smss.exe File created \??\c:\Windows\SystemResources\Windows.ShellCommon.SharedResources\PRIS\PRIS.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\r\r.exe smss.exe File opened for modification C:\Windows\l755277.exe smss.exe File opened for modification C:\Windows\036450635.exe lsass.exe File opened for modification \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\Admin Porn.exe smss.exe File created C:\Windows\036450635.exe system.exe File created C:\Windows\lsass.exe lsass.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\r\r.exe smss.exe File created C:\Windows\036450635.exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\Admin Porn.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\r\r.exe smss.exe File created \??\c:\Windows\InputMethod\SHARED\Admin Porn.exe smss.exe File created \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\r\r.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\New Folder(2).exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\r\r.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\Admin Porn.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\Foto Admin.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\Data Admin.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll service.exe File created C:\Windows\036450635.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\New Folder(2).exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\r\r.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll system.exe File created C:\Windows\35838\smss.exe system.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\New Folder.scr smss.exe File opened for modification C:\Windows\lsass.exe winlogon.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\Foto Admin.exe smss.exe File created C:\Windows\35838\bb412475l.com service.exe File opened for modification C:\Windows\35838\bb412475l.com service.exe File opened for modification C:\Windows\l755277.exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\Data Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\New Folder.scr smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\Foto Admin.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\Admin Porn.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\Foto Admin.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\Foto Admin.exe smss.exe File opened for modification \??\c:\Windows\InputMethod\SHARED\Admin Porn.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\f\f.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\r\r.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\r\r.exe smss.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\Data Admin.exe smss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile service.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 2844 service.exe 1012 winlogon.exe 3708 smss.exe 3976 system.exe 4392 lsass.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2844 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 89 PID 1304 wrote to memory of 2844 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 89 PID 1304 wrote to memory of 2844 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 89 PID 1304 wrote to memory of 3708 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 90 PID 1304 wrote to memory of 3708 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 90 PID 1304 wrote to memory of 3708 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 90 PID 1304 wrote to memory of 3976 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 91 PID 1304 wrote to memory of 3976 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 91 PID 1304 wrote to memory of 3976 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 91 PID 1304 wrote to memory of 1012 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 92 PID 1304 wrote to memory of 1012 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 92 PID 1304 wrote to memory of 1012 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 92 PID 1304 wrote to memory of 4392 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 93 PID 1304 wrote to memory of 4392 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 93 PID 1304 wrote to memory of 4392 1304 93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe"C:\Users\Admin\AppData\Local\Temp\93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\service.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\service.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2844
-
-
C:\Windows\35838\smss.exe"C:\Windows\35838\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3708
-
-
C:\Windows\35838\system.exe"C:\Windows\35838\system.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3976
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\winlogon.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\63736\winlogon.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
C:\Windows\lsass.exe"C:\Windows\lsass.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4392
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5a7f618a9f8e85aaee2b7053671dca94c
SHA163033e5564a8a5d27802e3bffdadbcf7e7ea3a12
SHA2567d4e216dcd0a8bc514e5ec3fb48eab567d7c7b7fc585a176270367974f6ef64d
SHA512fdbb023a0f8d7fb16869cb25f7de469cd54247d9bb371293ec4276ca1dcc926feb89e09e4f807021fbf48dcf5f2bec3b5ab092eb5e805c2071e90c02d95e115c
-
Filesize
64KB
MD58e1acdb764fc1c136f3869189fa7d52c
SHA1139e98dd38ba33da9282373387a4745d5f255989
SHA25686380e536b3a318d859e3cc57dd8faa2704e5f55522b4173aef2ed625a68987e
SHA512e2595493e1b79f1235b002018bbc72b5372ba92160af4bb2319f4f93986bb8ca8d4ab2b1418e82cc04b939fa22084f80614f89ffef91537c39e96a974422aa8d
-
Filesize
256KB
MD58f5d334a19ecd204e5aa1fd7268d3f4b
SHA12294eb28a22b57e10a4a65b1b60ab85e1b8a85c2
SHA25624525d36e3ee1547f4e4e8807fc4457fbf71be87ea419f19f4cfc5be35f87065
SHA512745c8329abb5a5e9c67828fcee3c38e643642fb8b743af6cf4b6dd9acba72b58410e693af1370bd3000e1650ee11c822562cbf48c9d4191ccc2a89d039d21fe2
-
Filesize
1.1MB
MD529d044809809aabd82305ce04ac88736
SHA1683b89f68681730e2828be556d5c687cc1a4a2bf
SHA25693d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c
SHA512a7517d7e12962ee42ff42fb941bc6756238cb9f157e8f14958563fc43f9929db8b3a76fd944d7136e21b5bc85178c76b2ba0e412ceb828a74e5b5e78b735c286
-
Filesize
176B
MD556473592d37a13c9098b21cb442e60fd
SHA16f0f49440289a6cef1d93e8c785747a3fb318688
SHA256acdcb1f96825ca74387ebe03f2a12291f7678da2cf6092607aea2dab6982cf35
SHA5126c635dc4f1ce55b54e39992531b0a4024c213af7fc3ab0f5b2642a932cb2201e7037a60e37c7aad42308ab7a84f0a2c655391935749d76f02ae7c3afd765dd2a
-
Filesize
120B
MD5a6f39a9b5556ce4c7cfd87677aa74224
SHA1d0216d0a0219a85e0cc803496542fef521d125fc
SHA25698a94698e85b53add5406bbebdee6d4e1fab5d50d773ecb0b6b45a2df4692b64
SHA512f3469c1e92b46cb023d0708d5de96ffca7665761a0749ff30d059b5e986e347aad98011117587c47ee08c5bb8eb9c8ebd69b4d842057f5f78bd6abfde903b73a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
192KB
MD5b1bbb62a1f02341bf14929284d985907
SHA160779a0498d314384b133ce737c39450a38be205
SHA256e8cd83998a18db42e3e2459ec00e2c0d54223446253030b332591b808a0af91a
SHA512ce73ec9202d8231fd44ad6bb88f30d64be9b99633f5e9a7803ea1db0883047ef26711cea21aa635f80b6b8d9c8477abd91b6190d647c81235c179ce4baf2c374