Analysis
- max time kernel
132s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 19:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe
Resource
win7-20240508-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe
- Size 91KB
- Sample240526-x7ktlsaa63
- SHA256 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93
- MD5 34f007980d9ce17bd05ef9f6328024da
- SHA1 1caa1b7fb3056c76295a83a875f3d3decbb8a586
- SHA512 32e5b32a12e066e78f205cd4e46474ccf4e6a3cd5f046ca7b04a155476017471f916b54097ef199ea3c9f524a2c864224755857daab135eaf70750be6bf01e62
- SSDEEP 1536:FAwEmBGz1lNNqDaG0PoxhlzmoAwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A8oGmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Detects executables built or packed with MPress PE compressor 19 IoCs
resource yara_rule behavioral2/memory/2344-0-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000233e7-8.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000233eb-106.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4844-108-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000233ef-115.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4844-114-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1272-116-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1272-120-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000233f1-122.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/2988-127-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000233f2-129.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000233f3-135.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4560-134-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4740-140-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000233f4-142.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/3040-147-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000233f5-149.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/2736-155-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2344-156-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Disables use of System Restore points 1 TTPs
- Executes dropped EXE 7 IoCs
pid Process 4844 xk.exe 1272 IExplorer.exe 2988 WINLOGON.EXE 4560 CSRSS.EXE 4740 SERVICES.EXE 3040 LSASS.EXE 2736 SMSS.EXE - Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\IExplorer.exe 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe File opened for modification C:\Windows\SysWOW64\shell.exe 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe File created C:\Windows\SysWOW64\shell.exe 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe File created C:\Windows\SysWOW64\Mig2.scr 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe File created C:\Windows\xk.exe 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 4844 xk.exe 1272 IExplorer.exe 2988 WINLOGON.EXE 4560 CSRSS.EXE 4740 SERVICES.EXE 3040 LSASS.EXE 2736 SMSS.EXE - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2344 wrote to memory of 4844 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 83 PID 2344 wrote to memory of 4844 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 83 PID 2344 wrote to memory of 4844 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 83 PID 2344 wrote to memory of 1272 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 84 PID 2344 wrote to memory of 1272 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 84 PID 2344 wrote to memory of 1272 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 84 PID 2344 wrote to memory of 2988 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 85 PID 2344 wrote to memory of 2988 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 85 PID 2344 wrote to memory of 2988 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 85 PID 2344 wrote to memory of 4560 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 86 PID 2344 wrote to memory of 4560 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 86 PID 2344 wrote to memory of 4560 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 86 PID 2344 wrote to memory of 4740 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 87 PID 2344 wrote to memory of 4740 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 87 PID 2344 wrote to memory of 4740 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 87 PID 2344 wrote to memory of 3040 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 88 PID 2344 wrote to memory of 3040 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 88 PID 2344 wrote to memory of 3040 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 88 PID 2344 wrote to memory of 2736 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 89 PID 2344 wrote to memory of 2736 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 89 PID 2344 wrote to memory of 2736 2344 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe 89 - System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe"C:\Users\Admin\AppData\Local\Temp\1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2344 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4844
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1272
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2988
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4560
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4740
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3040
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
- Size 91KB
- SHA256 bc91fc505dedb11c55b116dbd42504b5fca865d009c40b42f92342aa8d66d367
- MD5 f613b21f8192161ba522df183846bcd9
- SHA1 9c5b45a65d3e69ce8599b0e162c88e68e14ed61f
- SHA512 083c31c43da66dd6540f7d51d5122f021506cc45f665e34eb3303b7b19830788ced82be15c601a8291229680a18cf6d3e9439f265489849cf40b60c104603329
- SSDEEP 1536:FAwEmBGz1lNNqDaG0PoxhlzmSAwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A8SGmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
- Size 91KB
- SHA256 127d8c17ec55cf2fb362a82b6897b22217ace34070fbce94f8bd57ca0f7feaa5
- MD5 38eec6f143768efd792ddc26a7373d64
- SHA1 4aae45d4ef043eccbe1c50df520351e2b6b2de4b
- SHA512 5586ea69217bb5b17cd6a5ac02d049ed5b1ae5835d972b440545ba6b4b5d55059757d237064d7b0852c81e729af8c370f2fad60f7ba1044512a7278ce0f2d96a
- SSDEEP 1536:FAwEmBGz1lNNqDaG0Poxhlzm7AwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A87GmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
- Size 91KB
- SHA256 846d93f6b7de842f7c4c6406ce585f0d6acb37bb3d7533e1a25b90e5f7e52bd8
- MD5 4e07b246f2bc767aaa154d3c8315a630
- SHA1 e585fe038214a8961fc9a334e59ff18626b867b7
- SHA512 e95b6139fb506c8dca41df66be242ae2191a4ee1e7f9a1187cefdd5399f5ff5ee62d80d32322949f0fe6c9f632894331997692141f0113ecb350e7235f03e640
- SSDEEP 1536:FAwEmBGz1lNNqDaG0PoxhlzmkAwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A8kGmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
- Size 91KB
- SHA256 a029c3ca396e19bd1719599c8b1d93943257b66b8dfe644364a37225f2eb6926
- MD5 8169435356a570470df9fcd552dd7f2c
- SHA1 2917e457dedcf660c1f8b51023bafc2d31097212
- SHA512 ab569424913ecf3c544c986a572ff46b2779648f259788d5c26280bfe1a1edcc09d2a932d1eb15ed1a5a692c8113b5630caa5a545ac9783aafe8b294ca6fb77a
- SSDEEP 1536:FAwEmBGz1lNNqDaG0Poxhlzm9AwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A89GmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
- Size 91KB
- SHA256 05ff6acda1f6848d342e2df612bb23bb57a2292ec9b2b28e578688d77c08e4aa
- MD5 879803ddea587c7890349a26a6c96560
- SHA1 75505960578c6327dcf00ca94257bf8f827d1ec8
- SHA512 25d1ed4684df65e3a3dc8e88f86fe75ced963a7f37a07820beda5e53016f74983f0fe759fc925c64b6ba93f0ef070817670bebc0d7a751085934723bbf1e9e7d
- SSDEEP 1536:FAwEmBGz1lNNqDaG0Poxhlzm/EAwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A8/EGmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\winlogon.exe
- Size 91KB
- SHA256 1b71dbe44050382ce0479829d1b5e6dc9366e7bb1047149af699e65ef8571b93
- MD5 34f007980d9ce17bd05ef9f6328024da
- SHA1 1caa1b7fb3056c76295a83a875f3d3decbb8a586
- SHA512 32e5b32a12e066e78f205cd4e46474ccf4e6a3cd5f046ca7b04a155476017471f916b54097ef199ea3c9f524a2c864224755857daab135eaf70750be6bf01e62
- SSDEEP 1536:FAwEmBGz1lNNqDaG0PoxhlzmoAwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A8oGmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\IExplorer.exe
- Size 91KB
- SHA256 0874a2de095815f7eaaa03d7815e4aa484db3d61eafaf3410756f446ead5c028
- MD5 401267d082ed58dd29fcde2c7e1403df
- SHA1 e330241885b2e58244ca7e728e37eecde757ddc5
- SHA512 2c5aa524d60818880877ed76a3760e4ff515b60b1a1f810b0a8b3d828b2d491c2d431e11ccb9fa6d5fd01f6c5d752423b778d32ff696dc11d4af36118959882c
- SSDEEP 1536:FAwEmBGz1lNNqDaG0PoxhlzmOXAwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A8OXGmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\xk.exe
- Size 91KB
- SHA256 7ca2c1ff71ae768e8f9951ed2b81a79a3d391ea0128eb7fd1b83c88455b60233
- MD5 cb96dab05b4f5b64f37407f25cfb8c5c
- SHA1 c05da0c9af3d1e1207f0c36ec0582ee884228247
- SHA512 6cc4e10f61011bd006227361d80f7bfab829f8f5349be6087dacc5e2aac5c808f75f12a8fbf21cd7d019d967dcfb32e387f1c003f96c89df0db902909e07e4b0
- SSDEEP 1536:FAwEmBGz1lNNqDaG0PoxhlzmNAwEmBGz1lNNqDaG0Poxhlzm+:FGmUXNQDaG0A8NGmUXNQDaG0A8+
- MD5 SHA1 SHA512 SSDEEP