Analysis
- max time kernel
135s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 02:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe
- Size 91KB
- Sample240601-csjmsafc37
- SHA256 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef
- MD5 1aaddc9111d0f20c1f791705320b40e7
- SHA1 b804c718d7eb41f1b1e66a4bf92f9eb942c011ff
- SHA512 e76969b4c6029ef2fc995877bb2a9ea340165ab21f1fe4c9a54c082dcc9eb7124fb672c89ffd51fffdc13a4aa6949a591d48fbcc73b4d3d2a02cce6451c77f40
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6G1AwEmBZ04faWmtN4nic+6Gm:zGms4Eton01Gms4Eton0m
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Detects executables built or packed with MPress PE compressor 18 IoCs
resource yara_rule behavioral2/memory/1860-0-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023412-8.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023416-106.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002341a-111.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/3928-114-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2052-118-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002341c-120.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/8-125-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002341d-127.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/5036-132-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002341e-134.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4392-139-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002341f-140.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4388-145-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023420-147.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/2036-149-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2036-153-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1860-155-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Disables use of System Restore points 1 TTPs
- Executes dropped EXE 7 IoCs
pid Process 3928 xk.exe 2052 IExplorer.exe 8 WINLOGON.EXE 5036 CSRSS.EXE 4392 SERVICES.EXE 4388 LSASS.EXE 2036 SMSS.EXE - Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell.exe b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe File created C:\Windows\SysWOW64\shell.exe b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe File created C:\Windows\SysWOW64\Mig2.scr b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe File created C:\Windows\SysWOW64\IExplorer.exe b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe File created C:\Windows\xk.exe b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 3928 xk.exe 2052 IExplorer.exe 8 WINLOGON.EXE 5036 CSRSS.EXE 4392 SERVICES.EXE 4388 LSASS.EXE 2036 SMSS.EXE - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1860 wrote to memory of 3928 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 82 PID 1860 wrote to memory of 3928 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 82 PID 1860 wrote to memory of 3928 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 82 PID 1860 wrote to memory of 2052 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 83 PID 1860 wrote to memory of 2052 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 83 PID 1860 wrote to memory of 2052 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 83 PID 1860 wrote to memory of 8 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 84 PID 1860 wrote to memory of 8 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 84 PID 1860 wrote to memory of 8 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 84 PID 1860 wrote to memory of 5036 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 85 PID 1860 wrote to memory of 5036 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 85 PID 1860 wrote to memory of 5036 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 85 PID 1860 wrote to memory of 4392 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 86 PID 1860 wrote to memory of 4392 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 86 PID 1860 wrote to memory of 4392 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 86 PID 1860 wrote to memory of 4388 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 87 PID 1860 wrote to memory of 4388 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 87 PID 1860 wrote to memory of 4388 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 87 PID 1860 wrote to memory of 2036 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 88 PID 1860 wrote to memory of 2036 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 88 PID 1860 wrote to memory of 2036 1860 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe 88 - System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe"C:\Users\Admin\AppData\Local\Temp\b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1860 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3928
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2052
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:8
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5036
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
- Size 91KB
- SHA256 edb25b6f34ef545aec22063e8b235a281cd8f9f49ce2ce8e4238c7ea8626e2dd
- MD5 e3208ed8c9bb923696c82449e886d913
- SHA1 d3df0868fcb36bb8e9a42878909ecc8927de1956
- SHA512 c62adb9980fdb2a4bc7e8f2aca79013f5c05b4d19f9bbf9fe7b3cbcddd63e4417df30c7aa048dd7889b2c1165f48cbfd68ee87666aff42412701e76ea51aeee3
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GIuAwEmBZ04faWmtN4nic+6Gm:zGms4Eton0IuGms4Eton0m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
- Size 91KB
- SHA256 b2e09957f545491eb3324c0098f350e7cdc7e0e52bba08032a872eccc3b0a632
- MD5 5394f5b0bcff4221bcca70fff750637b
- SHA1 313cd4a27b0e162ae55dc6ddedbed6a7cdac1952
- SHA512 0bf37bdea888520b5afda0d780e7967fa5563ad77d8a71658302e978b70ae981dd186561d1470036a6d10197d432262ffd44375d918eec3503d4745578c6ffd8
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6G8AwEmBZ04faWmtN4nic+6Gm:zGms4Eton08Gms4Eton0m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
- Size 91KB
- SHA256 83a269e07c50197efaafb49dc4f5091615c2feca71a19fd707c55baf0d6e6e2d
- MD5 241f5a58e842a26f15caf543f8a17faf
- SHA1 19f4c5429121c5c03377684e6ea7e383ccef5c24
- SHA512 64e87364a820c4f2bac0ce62d4e0c140e0b8893c9a70e202da0c6bc39d562824885351755be95d14d3008d4c6fad05e6e1b879eb74b468f339a374edb0dc57af
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GqAwEmBZ04faWmtN4nic+6Gm:zGms4Eton0qGms4Eton0m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
- Size 91KB
- SHA256 5c11e5f19c0bdcc37163a9c86dbdf906103251b2c97f86d2d0820a7d084f17da
- MD5 b9eaefab996820e64965a4c9351d7603
- SHA1 838a395005edc1c1c979c8eeed32566d7fbaf13e
- SHA512 2b65e1b701006bd944827d386e2a6a06d46da40be51d5d3913d65a9a1dbe8ac1e9c6e4f956c045ec8a408ee689d66fc71cc88af4650be8fe834591b9e247c55a
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GHAwEmBZ04faWmtN4nic+6Gm:zGms4Eton0HGms4Eton0m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
- Size 91KB
- SHA256 c2a911da6cf5083a0c3eea20bef0cdf3b30c8844a3a454c25aca36e90c2b5fb7
- MD5 41bfa936308b32373e80ae397d4fc8cc
- SHA1 df1c101ca3f0faef5cbe818407dc5acc89b82c3e
- SHA512 78b3d18f927674e24c261472134a2f1bcee29436533b0c49cead7334b6481ce6e5073baaf93634dec3f67b88fc5e4bc9cf3c6c138f18903aad14d32422ce37d1
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GCAwEmBZ04faWmtN4nic+6Gm:zGms4Eton0CGms4Eton0m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\winlogon.exe
- Size 91KB
- SHA256 b7d2cc2ef9a3840242ede8013978ff473934614a7a998cbf6bb0e48853e894ef
- MD5 1aaddc9111d0f20c1f791705320b40e7
- SHA1 b804c718d7eb41f1b1e66a4bf92f9eb942c011ff
- SHA512 e76969b4c6029ef2fc995877bb2a9ea340165ab21f1fe4c9a54c082dcc9eb7124fb672c89ffd51fffdc13a4aa6949a591d48fbcc73b4d3d2a02cce6451c77f40
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6G1AwEmBZ04faWmtN4nic+6Gm:zGms4Eton01Gms4Eton0m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\IExplorer.exe
- Size 91KB
- SHA256 06f21d60dff40d7cab20c899c991b4ac58dee2d4b9a0d3daa2e12d3c8bb7c3f3
- MD5 31c083fc9fef15cef3aaf554ce983909
- SHA1 c22a66295ad3ee7aaa01648e9882076239ab95c2
- SHA512 f850f87600d313c436eafe7430a59f242c482e73ba01565b4d7df96da3e724ee13d4a22e4cc719c598426c2797a9ce30ff923746d689434c7db29ea113760112
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GGAwEmBZ04faWmtN4nic+6Gm:zGms4Eton0GGms4Eton0m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\xk.exe
- Size 91KB
- SHA256 89e83fe07c37b7618695e3f5b6bf8eaa2c95c5565a48ecc7e87258af618241c0
- MD5 27fd1b10184afd846886acb73e42b593
- SHA1 282f4cc117a78358b79b35278f6eeb99cd48944c
- SHA512 e2036cf3a3da0082813a8833f135f3ba2e2defb8219d6724ca6b3049d8e4ad0c345ea7d01abb1d67595caa09d969e73ce49052702a6abf6356c31a30f5edf4bd
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GHAwEmBZ04faWmtN4nic+6Gm:zGms4Eton0HGms4Eton0m
- MD5 SHA1 SHA512 SSDEEP