Malware Analysis Report

2025-01-06 10:33

Sample ID 240601-d5afbage2y
Target d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27
SHA256 d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27
Tags
upx evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27

Threat Level: Known bad

The file d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27 was found to be: Known bad.

Malicious Activity Summary

upx evasion persistence

Modifies WinLogon for persistence

Modifies visibility of file extensions in Explorer

UPX dump on OEP (original entry point)

Modifies visiblity of hidden/system files in Explorer

UPX dump on OEP (original entry point)

Disables RegEdit via registry modification

Disables use of System Restore points

Executes dropped EXE

UPX packed file

Modifies system executable filetype association

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies Control Panel

Suspicious behavior: EnumeratesProcesses

Modifies registry class

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 03:34

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 03:34

Reported

2024-06-01 03:37

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Disables use of System Restore points

evasion

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\xk.exe C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
File created C:\Windows\xk.exe C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1908 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\xk.exe
PID 1908 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\xk.exe
PID 1908 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\xk.exe
PID 1908 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\xk.exe
PID 1908 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\SysWOW64\IExplorer.exe
PID 1908 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\SysWOW64\IExplorer.exe
PID 1908 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\SysWOW64\IExplorer.exe
PID 1908 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\SysWOW64\IExplorer.exe
PID 1908 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 1908 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 1908 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 1908 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 1908 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 1908 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 1908 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 1908 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 1908 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 1908 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 1908 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 1908 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 1908 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 1908 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 1908 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 1908 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 1908 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 1908 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 1908 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 1908 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe

"C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe"

C:\Windows\xk.exe

C:\Windows\xk.exe

C:\Windows\SysWOW64\IExplorer.exe

C:\Windows\system32\IExplorer.exe

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"

Network

N/A

Files

memory/1908-0-0x0000000000400000-0x000000000042F000-memory.dmp

C:\Users\Admin\AppData\Local\services.exe

MD5 0a27a1ec7e224eb2b55f88fd8fb7d21b
SHA1 a30845c6d6deecdbd22da346c8ff37a647a051a0
SHA256 d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27
SHA512 577f02d35304d048ee5151af19849de10583f092b26087838445f28eece69ff34a02d39e21e4ea99b74cd6943dd1ff60e69eb440def17544e4f2e593e1775a9b

memory/1908-105-0x0000000002420000-0x000000000244F000-memory.dmp

C:\Windows\xk.exe

MD5 dd19fa12ae34aef8096125db8e9f154c
SHA1 e85ec4d3665a00a0eb29b486c8e446f9054e8d06
SHA256 d8724e2c6d1a4daa98b4be533c3c46b7950491de3a37934d7eb0b17eb171582b
SHA512 153e8c514be7a0abab020198b3c884dcafccbac6f636feac8fa445ae57b2250b65558b756939ffac0597d3840011ae80073e2ecac6ba92da26eec4e962ac5f00

memory/1908-112-0x0000000002420000-0x000000000244F000-memory.dmp

memory/2392-113-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2392-115-0x0000000000400000-0x000000000042F000-memory.dmp

\Windows\SysWOW64\IExplorer.exe

MD5 314a8a61994a7469bc7cc614791c4bd8
SHA1 7f8a7c4e156a47adf5a5d5d7c1afb4c9b3b6dcc5
SHA256 47ec58014730036192c9cbbc3956bd8a270f02db512df9788efe94dad1ebab47
SHA512 ebd63c3255e6ac8d6c79f8aac4707c5fb3f58743b5071b2c6a326d5ff6a1edf48ac362573a196ce7cdb7737f38dca5083c85a59fba080ab11f6f0ded63803003

memory/1908-123-0x0000000002420000-0x000000000244F000-memory.dmp

memory/2736-126-0x0000000000400000-0x000000000042F000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

MD5 43fcb8be6280f75e6a55c16d5757f8af
SHA1 f01d91af4581546cea1a254cb6025abafa61d0b5
SHA256 2cdd170d22efbe715fc777833923151b4e450a8750e3c80b29a3db7fdf16c67e
SHA512 2947f9446ab84f4ac0355a7a8eabe0f92dcc7942890414ca6768a16b79efcb190276fd19a62141effd1117e1228474513eec5fc8a79e2defcb76ba9f4e48aab4

memory/2308-138-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2308-136-0x0000000000400000-0x000000000042F000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

MD5 8f8d6ec68c419cc81c3064a685252bef
SHA1 347f2e8796d6a79f20969a4bd717072fb9c8f215
SHA256 efd698479fcec46d453ef2232b8cb631ceff2e760a1fbe3f80b9db71b851aaa4
SHA512 246502640266e6bb693e5328bb3da0e11e27d0231b5e41032ba0b364407b3276ba0a4ef650b618aab5fe58e3c856a3f221e417a79bfe9fee347ce5ed601b4ff7

memory/1792-147-0x0000000000400000-0x000000000042F000-memory.dmp

memory/1792-150-0x0000000000400000-0x000000000042F000-memory.dmp

memory/1908-146-0x0000000002420000-0x000000000244F000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

MD5 0109d5f9baf97418aaa3eeed7d224c21
SHA1 4f7f522f9610bfa1b05cea5823b9b1cc6d572cd4
SHA256 f771760c2eaaf572eeba1c3afee8dd167aabd8b6961d970e2cfdeb2574e5b013
SHA512 b646764ea357dd9a11e06e2e8fad3c540973f303ed7ed7fa5d6da23c554f75a7aa68dff8744d8f47a780f1682f5a23a701436f1bf891abcc80c3218af21ed7d8

memory/1908-158-0x0000000002420000-0x000000000244F000-memory.dmp

memory/1476-161-0x0000000000400000-0x000000000042F000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

MD5 9d2000882a74466a8f83262b54abab16
SHA1 b42b1fcde78165005e23854bc7496257dcf224a2
SHA256 c45e5ad576353872cab3b04f386fcaa115c66c9546754172dd9b57401b19d0fc
SHA512 c9a051c7b86fe60ad58f6ae26f1ffff1f5957fff70c200e041d1c66e3e932b4bdc5dd09ab238051efaf9979c91a4d70130050d74e3baa00b553afc9cdb95a81d

memory/1908-168-0x0000000000400000-0x000000000042F000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

MD5 cc74ffbde20be1eec92a4a8978599a1a
SHA1 38988651d651cf85b580204ceceb378c47386f99
SHA256 d58d0f5f9a2dbb8e5f8fcf3dddc8e0ca3c6f5f21d4fe9feef9fecdca98e022b1
SHA512 681b0f99c77078d6340085482a334df84669f655559e9a4b6389ceb3caf126f7a62bf6766f52ac199acba15e5958fc53c528242f87844b3ee51031fe28d18ea9

memory/1548-179-0x0000000000400000-0x000000000042F000-memory.dmp

memory/1908-181-0x0000000002420000-0x000000000244F000-memory.dmp

memory/1908-186-0x0000000000400000-0x000000000042F000-memory.dmp

memory/1412-184-0x0000000000400000-0x000000000042F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 03:34

Reported

2024-06-01 03:37

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Disables use of System Restore points

evasion

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\xk.exe C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
File created C:\Windows\xk.exe C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4376 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\xk.exe
PID 4376 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\xk.exe
PID 4376 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\xk.exe
PID 4376 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\SysWOW64\IExplorer.exe
PID 4376 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\SysWOW64\IExplorer.exe
PID 4376 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Windows\SysWOW64\IExplorer.exe
PID 4376 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 4376 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 4376 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 4376 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 4376 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 4376 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 4376 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 4376 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 4376 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 4376 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 4376 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 4376 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 4376 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 4376 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 4376 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe

"C:\Users\Admin\AppData\Local\Temp\d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27.exe"

C:\Windows\xk.exe

C:\Windows\xk.exe

C:\Windows\SysWOW64\IExplorer.exe

C:\Windows\system32\IExplorer.exe

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

memory/4376-0-0x0000000000400000-0x000000000042F000-memory.dmp

C:\Users\Admin\AppData\Local\winlogon.exe

MD5 0a27a1ec7e224eb2b55f88fd8fb7d21b
SHA1 a30845c6d6deecdbd22da346c8ff37a647a051a0
SHA256 d1ecbea4d739ea6eb1e111d8005e00e9d0749aefcc71aad359e4f8fdf4656a27
SHA512 577f02d35304d048ee5151af19849de10583f092b26087838445f28eece69ff34a02d39e21e4ea99b74cd6943dd1ff60e69eb440def17544e4f2e593e1775a9b

C:\Windows\xk.exe

MD5 b2c679d3a81d3a775daf150d1829747d
SHA1 bfaabb45c8458fdf5d9fc98765d29ce76861e149
SHA256 7386e1d48645e50617cc466c5104790e9bb8e2bfe932bfe7894ea8c531147f25
SHA512 64aa87dd993c0cf4e1b96a9e100f76c3030d9c412a25f5412470fec6bdfaac6d9de783666ee4ae1b0d3b8910f5c3ee08e3982b4f76bf69742d0b4331b184899d

C:\Windows\SysWOW64\IExplorer.exe

MD5 ae5f9c7207e39c607c0343d0f2717268
SHA1 f796a93d92ffe1e0e04a20eb04021e6286ffda3e
SHA256 9294326338698480bc6e40d4cb4dcba58a3ce334e976934f69101f833c25db63
SHA512 07f0f398164e4b523a81ae9b35b9cfbfa6f893a32881359b79ee092035596dd8b0b74a727e801695a9e182cc4e8b39eebc9a3cb6463667cefbae0ee56ee5eeaa

memory/1004-113-0x0000000000400000-0x000000000042F000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

MD5 3fb69f48f7f30ba33ec204a3326b86da
SHA1 5ab8d0afb7df084606a5955e0d6c928271637b93
SHA256 c0e5b18a4699eaacf8b818dd87593698ec712b69d88c3727eb944d9cd3ebc3ed
SHA512 19c08f67c7e25ccb393f0a47b6250d5693c3cb05d24a1d5fa0cdb97eccf11a31ef388674b73440b191cb7bd80240509083e3eacd45717177349bcc5ac1dbfca7

memory/2028-120-0x0000000000400000-0x000000000042F000-memory.dmp

memory/1480-126-0x0000000000400000-0x000000000042F000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

MD5 38403ef2c2fdf6f15bd15885c233ee64
SHA1 2bb158efe6bf1fba1c0c7945ec5d3ae86ed0329c
SHA256 f6748381f40d09908d4c769fdacc940304839efe75566fce7c16b820280639ab
SHA512 63738626810571b0912e48d6020c14bf45b86a5fc3649e76dc4d4505e22a7d998ee4253b6e722aa507e82aa1762bd762b50ad21768bb9fdd585d7b2e37536ff4

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

MD5 41c18873e65420283ab0cfd14399831d
SHA1 e7c7c0b14af513f743885c05c1f68291673a77e6
SHA256 f79c585a99c40810fbca4191fb40f5b93be061e016c15ab674035cc23e7bf6e7
SHA512 52289ed6fec4eb27e19c2afda7e7b240888c8b9ee1fb1098fe17597d479a434452de91a8140f9c002a041eba9390692825af51eb003a764fde38fe9236e88a7e

memory/1064-135-0x0000000000400000-0x000000000042F000-memory.dmp

memory/384-139-0x0000000000400000-0x000000000042F000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

MD5 c613d7730d8ca092db2adee5e41231d5
SHA1 34b86339f8b12c403f8040d67d14525a261ef56c
SHA256 a95063c1479f309c41e74d58548d4a8a9e921d36f60114d97bc14441ef5e8a92
SHA512 cd2246b35de24c5b1f76784e023e537c7cf3ea69387398a4ee8436eb486044e7e5ced8c97a46a13e04698ef2ff3994e825ed5b14a8eb8ad69f77e590255edcde

memory/3616-145-0x0000000000400000-0x000000000042F000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

MD5 21bb7c05ac6237a55f199a2b2860365e
SHA1 6f23409caa7bc741cd0ac0377d44ec0868cd7f7b
SHA256 7bb8fc9c7518841e3b88911115797d9fc3c46d66af8695049a9b73a24e76c934
SHA512 471595a647cb4987c392a4b914e7db3329ca82796b66aa1f3ede0330d0fa2a2cf2c555d131925ad05e509cb3f254ceaf870346f6fcdba5c449497640304dc91f

memory/4376-153-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2020-152-0x0000000000400000-0x000000000042F000-memory.dmp