Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 03:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Eleven.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Eleven.exe
Resource
win11-20240508-en
windows11-21h2-x64
18 signatures
150 seconds
General
-
Target
Eleven.exe
-
Size
246KB
-
MD5
c3050a0c5265ec60b0cfba5283aaedad
-
SHA1
fe0b37ad1b70bf454d760e370fbdcf108e18b59a
-
SHA256
8640f526d35e7af50d43e9b15a90b35b0f45d213bc680842108e982d337dc0b4
-
SHA512
e008e49020ce505c3f75eb051d64eccfd3ca2b81b851ddbfdd2df44d234fdec6034590c73ef466406824a03e394be60c772b3ea3ce6f297c09f573868a02fc80
-
SSDEEP
6144:j+x/LcTEyF1dH3VOVw44UOisbaxHUsAxyOzk9jAOb:/BREcUkHxy8yA
Score
10/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection Eleven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Eleven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Eleven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Eleven.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Eleven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Eleven.exe -
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Eleven.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\coz1ytcr.s0s Eleven.exe File created C:\Windows\SysWOW64\drivers\hesbcxgt.s0s Eleven.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Eleven.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features Eleven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Eleven.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Eleven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Eleven.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 6 raw.githubusercontent.com 5 raw.githubusercontent.com -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ras\zbmnhkag.s0s Eleven.exe File created C:\Windows\SysWOW64\i0sn2glp.s0s Eleven.exe File created C:\Windows\SysWOW64\zthufgus.s0s Eleven.exe File created C:\Windows\SysWOW64\Msdtc\Trace\bttdpbvd.s0s Eleven.exe File created C:\Windows\SysWOW64\fr-FR\storeoqc.s0s Eleven.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\rbysi4fj.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\ktqsjv5g.s0s Eleven.exe File created C:\Windows\SysWOW64\lyqmvui3.s0s Eleven.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\rg4us0pc.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\tsji0zf4.s0s Eleven.exe File created C:\Windows\SysWOW64\Msdtc\Trace\f0klyxom.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\av00psai.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\siph1c34.s0s Eleven.exe File created C:\Windows\SysWOW64\hjk5lx1k.s0s Eleven.exe File created C:\Windows\SysWOW64\yjp4bgr1.s0s Eleven.exe File created C:\Windows\SysWOW64\jwodwql1.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\tiadlt0n.s0s Eleven.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\20zncjk2.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\yyy2rgw1.s0s Eleven.exe File created C:\Windows\SysWOW64\ma312z2m.s0s Eleven.exe File created C:\Windows\SysWOW64\alts3gv1.s0s Eleven.exe File created C:\Windows\SysWOW64\icsxml\3htdf14n.s0s Eleven.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\pvx5dckp.s0s Eleven.exe File created C:\Windows\SysWOW64\wtpagcuf.s0s Eleven.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\0xai05kq.s0s Eleven.exe File created C:\Windows\SysWOW64\ras\n0lhw535.s0s Eleven.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\500sxi1u.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\q3r141ui.s0s Eleven.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\42x5lzgd.s0s Eleven.exe File created C:\Windows\SysWOW64\swky2buu.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\dcc1ehsp.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\tgltwtvm.s0s Eleven.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\nii2vz43.s0s Eleven.exe File created C:\Windows\SysWOW64\es-ES\gyrfnxhx.s0s Eleven.exe File created C:\Windows\SysWOW64\lxfk1jy0.s0s Eleven.exe File created C:\Windows\SysWOW64\wzdmlvky.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\iq2f1xv0.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\nchrztin.s0s Eleven.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\r0lv5mdb.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\zsezjme1.s0s Eleven.exe File created C:\Windows\SysWOW64\en-US\rlu5chms.s0s Eleven.exe File created C:\Windows\SysWOW64\F12\dyrt44h1.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\ey4dp3gs.s0s Eleven.exe File created C:\Windows\SysWOW64\fr-FR\4eaxhwd1.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\l42kfjlh.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\ihyf13yn.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\l3w1ktsu.s0s Eleven.exe File opened for modification C:\Windows\SysWOW64\Eleven.exe Eleven.exe File created C:\Windows\SysWOW64\cpo4sf0u.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\tilixaze.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\vj2yosja.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\ry3see2x.s0s Eleven.exe File created C:\Windows\SysWOW64\Recovery\fgqyayx5.s0s Eleven.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\xtecucti.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\pgmrp3pu.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\iuvum2q3.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\hyckuigk.s0s Eleven.exe File created C:\Windows\SysWOW64\fr-FR\zhye2pbt.s0s Eleven.exe File created C:\Windows\SysWOW64\wbem\cvnl2lzy.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\kvbdbwbb.s0s Eleven.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\foolszqf.s0s Eleven.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\jncb1nja.s0s Eleven.exe File created C:\Windows\SysWOW64\MSDRM\o2lkvt1d.s0s Eleven.exe File created C:\Windows\SysWOW64\5t4tsmiw.s0s Eleven.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp4769.tmp" Eleven.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\jj2h2jko.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\thb2asl1.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\w4as4rio.s0s Eleven.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\cjm3uoqg.s0s Eleven.exe File created C:\Program Files\7-Zip\Lang\4j4r0hbe.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\mxxeyuqa.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\nb0mucgj.s0s Eleven.exe File created C:\Program Files\7-Zip\Lang\ma3eo542.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\p0qrkqcd.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\1nbvgeo4.s0s Eleven.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\rccra0fz.s0s Eleven.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\45n2ymih.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\irxee3vz.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\0rmchrop.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\hwzj44ug.s0s Eleven.exe File created C:\Program Files\Microsoft Office\fjsjdlzv.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\00rwisuv.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\eeawj4py.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\lujkhbl0.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\ccunkqag.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\y2aetg1r.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\1dr2hlwd.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ikvfksct.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\su13mnpr.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\ueq2fyvj.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\h1lxop4i.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\mrfpaas3.s0s Eleven.exe File created C:\Program Files\Common Files\Services\xbworb50.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\t3lbfs5d.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\qyumkbfu.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\1oyf5h2r.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\35dhiyye.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\wqkk52hb.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\ylf4qlmh.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\fxbix5jb.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\0yq3aqbv.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\x5hhoaus.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\sihhq4vz.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\3tb55cqd.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\ff0smsvi.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\hzmh3rvq.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\bxsuawby.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\jnzyecgb.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\ixh1fg52.s0s Eleven.exe File created C:\Program Files\Microsoft Office\root\Integration\voi2o5vp.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\ylxyxwrd.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\2nvihsno.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\0qw02cae.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\1p1amv0m.s0s Eleven.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\3ypywiov.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\yergbq05.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\cmnccjvk.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\w0cqfjvu.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\g531icpe.s0s Eleven.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\jvgg1orv.s0s Eleven.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\4sbmml31.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\yqusenfv.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\eiftxkby.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\4nmv2otv.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\atalxnig.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\mtltzxfn.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\vvtpmhve.s0s Eleven.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\wxfxl1dp.s0s Eleven.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\rtnovbs3.s0s Eleven.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_e712e6b5052a090d\j0imi3rr.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\1l1a1200.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_dual_mdmusrsp.inf_31bf3856ad364e35_10.0.19041.1_none_599b72ea879e5204\corzc45i.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\mz2n2swi.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\qs20joqr.s0s Eleven.exe File created C:\Windows\diagnostics\system\IEBrowseWeb\u22bjpkh.s0s Eleven.exe File created C:\Windows\diagnostics\system\WindowsUpdate\er1hvnrz.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\opp30cvx.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\axn4hhsv.s0s Eleven.exe File created C:\Windows\diagnostics\system\WindowsUpdate\wjj0jryq.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..iencehost.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_fb71c64c36f7dd93\bxcqa133.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\uvyziwti.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\gz4w4zw3.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_dual_cpu.inf_31bf3856ad364e35_10.0.19041.546_none_2c9fc8ea9f807c07\xkda5ovm.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_dual_acxhdaudiop.inf_31bf3856ad364e35_10.0.19041.1151_none_ee7c5953ab83c1f8\f\fxrruprq.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-editions-professional_31bf3856ad364e35_10.0.19041.1288_none_51444fcfcf940a66\ecjbywjz.s0s Eleven.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\f12host\mwcwmgvd.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-psmgmttools_31bf3856ad364e35_10.0.19041.1_none_ea59ac6cb66d674b\wjep3b43.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\2gaqim11.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1266_en-us_68eabd5c6b1d4e11\owr12se2.s0s Eleven.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\1qluqa42.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1_none_11b2da2074e7d6e4\13jzsnhf.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_dual_netbvbda.inf_31bf3856ad364e35_10.0.19041.1_none_1939626c2515b8ad\ovpow2go.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\lr4tmtss.s0s Eleven.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\speech\0c0c\mabjpnto.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\ffr2peac.s0s Eleven.exe File created C:\Windows\PLA\Rules\es-ES\omtobdud.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_dual_iai2c.inf_31bf3856ad364e35_10.0.19041.1_none_f7e054d19476382b\uwizczah.s0s Eleven.exe File created C:\Windows\WinSxS\x86_netfx4-cfx_extended_sql_files_b03f5f7f11d50a3a_4.0.15805.0_none_be318b1e895e8b23\pmsy0uza.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\zqafpelt.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\x0juwxmp.s0s Eleven.exe File created C:\Windows\WinSxS\x86_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_10.0.19041.1_de-de_00452fa28b562294\kcwd3sq5.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ore-files.resources_31bf3856ad364e35_10.0.19041.1_it-it_0bf4c007e9677824\4kju5vjh.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\psz2ymq3.s0s Eleven.exe File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\4qb1yxv3.s0s Eleven.exe File created C:\Windows\PLA\Reports\e1rioel5.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\qn2lnj0m.s0s Eleven.exe File created C:\Windows\PLA\Reports\ja-JP\ppy04bva.s0s Eleven.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Assets\t4dk2slk.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\1tsgng3v.s0s Eleven.exe File created C:\Windows\diagnostics\system\IEBrowseWeb\fes31s2k.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\yk3katj0.s0s Eleven.exe File created C:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\xedttn2y.s0s Eleven.exe File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\yd0mvmj0.s0s Eleven.exe File created C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\1ab3htdp.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\bzcr2xxv.s0s Eleven.exe File created C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_es-es_80b0e69d86443d44\meocppma.s0s Eleven.exe File created C:\Windows\ImmersiveControlPanel\oppyuoth.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\3fif112w.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..iencehost.appxsetup_31bf3856ad364e35_10.0.19041.1_none_3c8b1d422130f806\g5qmrv2a.s0s Eleven.exe File created C:\Windows\Media\hmiuuqny.s0s Eleven.exe File created C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\3rkeq0aa.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\mkrhf3l1.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.19041.1_none_45dc4032c659ae7c\mr5rj431.s0s Eleven.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\bzszxbua.s0s Eleven.exe File created C:\Windows\Media\xkmj5nrw.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\zpe5aahj.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\Assets\4wcq3m40.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\Assets\dhplmzlz.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\gj5g4w52.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\aieuzi30.s0s Eleven.exe File created C:\Windows\INF\hcdip1tr.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\bchk1j0c.s0s Eleven.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..g-fdprint.resources_31bf3856ad364e35_10.0.19041.1_de-de_7c4d9c753a9353b6\e040nwg0.s0s Eleven.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2012 schtasks.exe 3024 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3828 powershell.exe 3828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1356 Eleven.exe Token: SeDebugPrivilege 3828 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1356 wrote to memory of 2012 1356 Eleven.exe 84 PID 1356 wrote to memory of 2012 1356 Eleven.exe 84 PID 1356 wrote to memory of 2012 1356 Eleven.exe 84 PID 1356 wrote to memory of 3024 1356 Eleven.exe 86 PID 1356 wrote to memory of 3024 1356 Eleven.exe 86 PID 1356 wrote to memory of 3024 1356 Eleven.exe 86 PID 1356 wrote to memory of 3828 1356 Eleven.exe 91 PID 1356 wrote to memory of 3828 1356 Eleven.exe 91 PID 1356 wrote to memory of 3828 1356 Eleven.exe 91 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Eleven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Eleven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Eleven.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eleven.exe"C:\Users\Admin\AppData\Local\Temp\Eleven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1356 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Windows Update" /tr "C:\WINDOWS\SysWOW64\Eleven.exe" /sc MINUTE /mo 1 /ru SYSTEM /f /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:2012
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Windows Update" /tr "C:\WINDOWS\System32\Eleven.exe" /sc MINUTE /mo 15 /ru SYSTEM /f /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:3024
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a7b82f7c-73a1-4f1e-b6f0-3c377fa780a8}\up5nyik2.s0s
Filesize16B
MD58b6174b915f739c1c9f3ffd16056b663
SHA114ce561e085828e8d29120af5e61fa8c76438120
SHA25692810fc1d064507a328c34eaa18e7ec990eec023afa114c90331601c16d0fd0c
SHA512f7bd5079f9e2fcafdfde9d1461318ac50a5999926b263e2276b8b2fc52d1515daa10d6ab94f387b6e3d35c066004e44f16c6621fb47d344cd93b4656d2f8eedc
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a7b82f7c-73a1-4f1e-b6f0-3c377fa780a8}\wphe0ph1.s0s
Filesize16B
MD558d730d71c9194cd0fc2c3fc4ce869c5
SHA158df2056b36435d33582f8a41b96803ff03a32b0
SHA256198b0f02fbf58fee533102d71c2085fadeea9f66881663f9028b554ece49a8cc
SHA5129f8cc0a05f2b18649538344c89319263db0b7e7f7aa476b6e86a54c8e384654d0cc09653b17ff3ffec2a3450acc203be1d1401ed9de3e07fdf0da9b938cfd2b9
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\4ioubuci.s0s
Filesize48KB
MD566970bd68fc0ba5f6eb9e82b57f0e0f3
SHA1a2163d9bd6d619e25be8d45ff587d6190ba30d75
SHA2566e26234d4fc89bb9de8b4d3d31db5ce1cba8c3a6f6ec6c8c2acbbc6e9d5cce5f
SHA512b2e543d05e32f5a5e4041db450107d6fc84c1ac7e6564ac86d35e686b590e951d3757465a7c26b8f5ce8320e6b46ff495f73765d9a9a9b99e27c158c65233f80
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\k1twd3nz.s0s
Filesize66KB
MD52754ecd7ef2d17cd93d691462debfa1c
SHA152d2719252ac8806e35844f0356c0dd05b0048bc
SHA256ad2d1dd6f64090c7967364411583ef9814d76f7d340427f7ecfc148effa19d64
SHA5122ddac67f51f00d61bbb37930d0dfff4f0ff098746ba1e703f8361680f14b8d8f3279bc3d1d771c5b1324e10d747681adc4aa75331adf4affd2f305de4ae9db9f
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\lbkrva3s.s0s
Filesize77KB
MD5e602432012c54b965ef88becbb147a00
SHA19504b71e581f07bbc0f519eba9edf842c072f79d
SHA2569f30546487bd37142cd719f0fff08caa04d63ac786a67270303ba09bf715f238
SHA5121878750d845e3db96e3ad4d78d3812b89989b857fdbaa1e3774dc676b09cadf40de10eb9c8cededc6f56f5d99b99e9dcdb441d90e165fd0234ffafc02195fc3d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
992B
MD5c9421d0fb37360e6f75971de6dd6f159
SHA1addc74e375a4fe237914ec6d026e3fcfef682813
SHA2563861e75c8df8ba37fbebf100e356fd50b0cd1ee924549fdb0c705c0feaaa3e73
SHA512ae37bb70f34c9cd84ca263df291fc0484192ee9d99f6dcc3272fbb2636c9a0cb240091c1a5acde2298fe48fd5747a0682c597e5f5a0e68c7b2b3d7b52ff78371
-
Filesize
576B
MD59da24842d7efe85aecff90fd3ba994b5
SHA1392c3cc879d1a5d44200f91ccdf8fde60f538734
SHA2560005186a23a5acd30a5fe296f168e6ae7bc1edd92972af38809405fa81f4d0af
SHA5126dc1b1e6376a9b9b383222520be974e969abefb32142af879e87a84c81e7707b85ecdd47328afa9770bd0c891c4805fc8ed74ff1b0d56eefd4e3978b739c7c95
-
Filesize
368B
MD520979b47276d4509f0da18b6ebfe4bde
SHA198110c602dacc7434b2e22de86df049c25ffd42f
SHA256fe8475f04260a271e7d2a134c34a72c463fc825c410b6d65bf769b0008f10364
SHA512258c7acfb659a18f27f8587f31e0454e48fd01f04219fd85fbe49fdaf39a00197e3d0686f3e9d61080273a6460375afd60d96d2590bdfe34d4690907e208a998
-
Filesize
104KB
MD5db59429f6463fe62978c948a4388b25e
SHA10fc8ed213126131acfaed948a65be0836bd1136e
SHA25636a68b607a16be8a5c5c2a118e69a2655c22a7302486e55817cc066c0ac05d15
SHA5123bc102dda05a9edf3dda2e57162133d7a5ff1c7c393c9b84caf6234276eecf75a88d8017bc44719f24406dff9f049ca88818a600328fd0456a34ffe4d3da6e83
-
Filesize
56KB
MD5cd60e4f4bd8d8f1a236d883e19b4a1c5
SHA1ddfe00c2796b647ae97c5a3882d5f6af7d640739
SHA256a5aebcb48ec8dd398ec364a2e75e1ce2dbec5f1d50ccbada4849c722ebd38eb0
SHA5125ae6583701cc09f2ae00437f3e6749bebcb0efa998c36726f5bcbeaed02c242cca07594653b24a3357649bf98a63164a2c7d7bfe17f237639d938699d68ed434
-
Filesize
992B
MD58a48aa1c8b610ec7491d7cf5b0fe3e9a
SHA1391e9b5aec8749918e08d55cb6148de334a774e8
SHA2561c613213246fda71c134ed1733959bd36bdfd1e4c6d45817069c7a79d86ceabb
SHA51243664d21038aeb2c422bc6948533c6112c5435d6fc7b66225b841a0dd38aaa3659893de1c1af274a773f757cb44680739971f5c0ab7f99649d60d637005bc24a
-
Filesize
30KB
MD5ac4c9912557e7dc17a1659721e7bbd9d
SHA130e643309fda62bed4d15cd99a14d224b6e35deb
SHA256c86a0ce403c1ba567d83fdb404c2d7abda23bae0ea26dbf93bbcc09517ba1c96
SHA512577d467ebee57f75b3ec4e92f7ff6fe1f33c7536be098295c314037633e5aea2da5529c5d3e39d8917ac480a364fb394f6be29fd25a87f94463875933ac84530