Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 04:00
Behavioral task
behavioral1
Sample
da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe
Resource
win10v2004-20240508-en
General
-
Target
da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe
-
Size
91KB
-
MD5
08eca8d511f841708bda81cc3d9c1d8e
-
SHA1
d02e9bdd5f24617b7c661f58da29871201b9c794
-
SHA256
da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1
-
SHA512
df551185ccfe29e286520fe661c255bff27ad2b7fefb0c566b5d2c23220b3ba5720db157dd80a05aa65cfa19349cfc5a277aa2f0ad8ffce4e6699ccb888a6182
-
SSDEEP
1536:ERsjdf1aM67v32Z9x5nouy8VTkRsjdf1aM67v32Z9x5nouy8VTU:EOaHv3YpoutNkOaHv3YpoutNU
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral1/memory/2296-0-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/files/0x00070000000145bc-8.dat UPX behavioral1/files/0x000700000001473e-108.dat UPX behavioral1/memory/1224-115-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/memory/1224-113-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/files/0x0006000000015c8c-116.dat UPX behavioral1/memory/2760-127-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/files/0x0006000000015cb7-128.dat UPX behavioral1/files/0x0006000000015cbf-137.dat UPX behavioral1/memory/2772-140-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/files/0x0006000000015cd6-148.dat UPX behavioral1/memory/1020-151-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/memory/1548-161-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/memory/1548-159-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/files/0x0006000000015ce2-162.dat UPX behavioral1/memory/2296-170-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/files/0x0006000000015cea-173.dat UPX behavioral1/memory/2388-175-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/memory/2020-182-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/memory/2020-187-0x0000000000400000-0x000000000042F000-memory.dmp UPX behavioral1/memory/2296-188-0x0000000000400000-0x000000000042F000-memory.dmp UPX -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 7 IoCs
pid Process 1224 xk.exe 2760 IExplorer.exe 2772 WINLOGON.EXE 1020 CSRSS.EXE 1548 SERVICES.EXE 2388 LSASS.EXE 2020 SMSS.EXE -
Loads dropped DLL 12 IoCs
pid Process 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
resource yara_rule behavioral1/memory/2296-0-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x00070000000145bc-8.dat upx behavioral1/files/0x000700000001473e-108.dat upx behavioral1/memory/1224-115-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1224-113-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0006000000015c8c-116.dat upx behavioral1/memory/2760-127-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0006000000015cb7-128.dat upx behavioral1/files/0x0006000000015cbf-137.dat upx behavioral1/memory/2772-140-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0006000000015cd6-148.dat upx behavioral1/memory/1020-151-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1548-161-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1548-159-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0006000000015ce2-162.dat upx behavioral1/memory/2296-170-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0006000000015cea-173.dat upx behavioral1/memory/2388-175-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/2020-182-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/2020-187-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/2296-188-0x0000000000400000-0x000000000042F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell.exe da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe File created C:\Windows\SysWOW64\shell.exe da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe File created C:\Windows\SysWOW64\Mig2.scr da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe File created C:\Windows\SysWOW64\IExplorer.exe da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe File created C:\Windows\xk.exe da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 1224 xk.exe 2760 IExplorer.exe 2772 WINLOGON.EXE 1020 CSRSS.EXE 1548 SERVICES.EXE 2388 LSASS.EXE 2020 SMSS.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2296 wrote to memory of 1224 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 28 PID 2296 wrote to memory of 1224 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 28 PID 2296 wrote to memory of 1224 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 28 PID 2296 wrote to memory of 1224 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 28 PID 2296 wrote to memory of 2760 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 29 PID 2296 wrote to memory of 2760 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 29 PID 2296 wrote to memory of 2760 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 29 PID 2296 wrote to memory of 2760 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 29 PID 2296 wrote to memory of 2772 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 30 PID 2296 wrote to memory of 2772 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 30 PID 2296 wrote to memory of 2772 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 30 PID 2296 wrote to memory of 2772 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 30 PID 2296 wrote to memory of 1020 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 31 PID 2296 wrote to memory of 1020 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 31 PID 2296 wrote to memory of 1020 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 31 PID 2296 wrote to memory of 1020 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 31 PID 2296 wrote to memory of 1548 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 32 PID 2296 wrote to memory of 1548 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 32 PID 2296 wrote to memory of 1548 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 32 PID 2296 wrote to memory of 1548 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 32 PID 2296 wrote to memory of 2388 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 33 PID 2296 wrote to memory of 2388 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 33 PID 2296 wrote to memory of 2388 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 33 PID 2296 wrote to memory of 2388 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 33 PID 2296 wrote to memory of 2020 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 34 PID 2296 wrote to memory of 2020 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 34 PID 2296 wrote to memory of 2020 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 34 PID 2296 wrote to memory of 2020 2296 da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe 34 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe"C:\Users\Admin\AppData\Local\Temp\da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2296 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1224
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2760
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2772
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1020
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2388
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD508eca8d511f841708bda81cc3d9c1d8e
SHA1d02e9bdd5f24617b7c661f58da29871201b9c794
SHA256da4dff87a92b9af2aafa20a00ca67c8bac4c4e7a5693d851397ad6949f3d36f1
SHA512df551185ccfe29e286520fe661c255bff27ad2b7fefb0c566b5d2c23220b3ba5720db157dd80a05aa65cfa19349cfc5a277aa2f0ad8ffce4e6699ccb888a6182
-
Filesize
91KB
MD5a6ec707e10234aac22e9d0adff2bc5b4
SHA173ec514f5fb29e893995fed425a56cdcdb2f9e8d
SHA256a5a7eb4f1aa2b38a335264986e51b68246c18f21cd1edc23eb7d5efbb8e67cfa
SHA512bfc466e2becc05173a5fd46c29a0d33572a2f99ee983c0de7873fa3a1311f87e4f77aa9ad1f38e92fb26b7453da2480e055a2f00282b9e3b714d8c9e0656cce7
-
Filesize
91KB
MD59eeb06765d71e5fa1b91b4a09266857d
SHA1c71108b4b5e0bf66e4d15db54cd15650f04cb527
SHA256a86c9e561fb43463a64936d897ac13310b60081ace30798a52dccaf033fcc9aa
SHA512132808c5ab99a02125b48f7927563cbe94ad90f7b67c87cd9781bd1901d1ccb0063f28655b0f5577e7c66f6ac0a86bb68f8008a14d50e0d8f9455d8ed6b12919
-
Filesize
91KB
MD52fb55003b024e19582b71453bab08167
SHA1d4fe35c302c31aea8af2215acc9787f682be8791
SHA256cc62de6243b465e250de00db006b5048dd24e379c17c5d27de9a5d73dfee1389
SHA512a75455291293f1795e1be499edf0a878d83a943768f64ccefdc92908567a351af6becfe268d7147a44d6273bd8ca789556fa28ef0424e63a8a5118efcefae808
-
Filesize
91KB
MD546c0257d5478d16bae9ef94ca330f3f8
SHA1881ce0bc5b063582848e624d9d6b9b4f13fe39b2
SHA2562ff5d800c5ef63b3e4d8cb5f4ace54ef5e9710d42525e56c953921f7da4dc313
SHA5120fd9017d95d9ca239c2e8d2092b6e9c051855bd80897e33e1cc98b2069fc7878e02c479ddc5783c1cf6630132db4987e14d382c1f7396ff84e89cdb3807320eb
-
Filesize
91KB
MD58036a71cbdd84f6e150220afaa168c78
SHA16f187420d427de99c5fb1f08d67f8acb8366d71f
SHA256bbafefcb9945a98bc102347fedeb7feaee8c645646871a92d59b18091dca242b
SHA512d2cd0f01b5af9f9b59283ba2467964ca24eb458ccdf6f3228b1f33e73487d96f4742ea34ccbd40e90c4f6745639cebfd7e68cb136cbb6ea1378cd5924d417395
-
Filesize
91KB
MD5d45ff9133ef40756d81c745d64b696c5
SHA131d56c208903e49b55f56c1e6dc705175b81c166
SHA2560395b22c135b102005e371094da9137c2ae24fde9c9e5afd05a12f66c500c66a
SHA512c9595802e1aea58c9e6def454e8051260d636147ca7d737c783a6c1286cdeafaad9b2e5e16234967b2c78db6bdb1dd80ff3566c96b2e232f314c37eb69ad4c57
-
Filesize
91KB
MD53788c0d990c32dbd4c90bcd5b3bf3d6f
SHA1f530d404919daf03e600bc0719e0a269d4481384
SHA2568ffe8bfab1ae0f760fd7c9884138a1285365bb5a959ad2e6c482a7f36bb5a1ef
SHA5122697e3f40cf3e5cfbc8d22f671779fd7055c5fd57ef1109d6b54a5d194d84a8ec9c743a1d78d8e8c8986e3c3bd483001825f89401735309295273752ba4b1344