dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Size 91KB
Sample240601-esdsmsaa99
SHA256 dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e
MD5 7115016190bd18b9033384e133486351
SHA1 c421e3a01d36d2caccfc4dae05e4294b3f6c2edf
SHA512 a07ca85790def168d44a5a9db4a7fe763304fa9c9e4461479c264a0ac9a2a7f07b90051ca2c519e51739336a8a4edbd89b78d246967c77838c365e17f89e02d3
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTdRsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutNdOaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

UPX dump on OEP (original entry point) 19 IoCs

resource	yara_rule
behavioral2/memory/2668-0-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-8.dat	UPX
behavioral2/files/0x000700000002341c-106.dat	UPX
behavioral2/files/0x0007000000023420-112.dat	UPX
behavioral2/memory/4296-114-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/memory/1844-115-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/memory/1844-118-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x0007000000023422-120.dat	UPX
behavioral2/memory/3476-125-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x0007000000023423-127.dat	UPX
behavioral2/memory/2856-132-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x0007000000023424-135.dat	UPX
behavioral2/memory/4960-136-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/memory/4960-140-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x0007000000023425-142.dat	UPX
behavioral2/memory/4792-149-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-147.dat	UPX
behavioral2/memory/1200-154-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/memory/2668-155-0x0000000000400000-0x000000000042F000-memory.dmp	UPX

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
4296	xk.exe
1844	IExplorer.exe
3476	WINLOGON.EXE
2856	CSRSS.EXE
4960	SERVICES.EXE
4792	LSASS.EXE
1200	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2668-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023418-8.dat	upx
behavioral2/files/0x000700000002341c-106.dat	upx
behavioral2/files/0x0007000000023420-112.dat	upx
behavioral2/memory/4296-114-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/1844-115-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/1844-118-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023422-120.dat	upx
behavioral2/memory/3476-125-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023423-127.dat	upx
behavioral2/memory/2856-132-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023424-135.dat	upx
behavioral2/memory/4960-136-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4960-140-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023425-142.dat	upx
behavioral2/memory/4792-149-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023426-147.dat	upx
behavioral2/memory/1200-154-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/2668-155-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
File created	C:\Windows\SysWOW64\shell.exe	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
File created	C:\Windows\SysWOW64\Mig2.scr	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
File created	C:\Windows\xk.exe	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop\	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
4296	xk.exe
1844	IExplorer.exe
3476	WINLOGON.EXE
2856	CSRSS.EXE
4960	SERVICES.EXE
4792	LSASS.EXE
1200	SMSS.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4296	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	81
PID 2668 wrote to memory of 4296	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	81
PID 2668 wrote to memory of 4296	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	81
PID 2668 wrote to memory of 1844	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	82
PID 2668 wrote to memory of 1844	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	82
PID 2668 wrote to memory of 1844	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	82
PID 2668 wrote to memory of 3476	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	84
PID 2668 wrote to memory of 3476	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	84
PID 2668 wrote to memory of 3476	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	84
PID 2668 wrote to memory of 2856	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	85
PID 2668 wrote to memory of 2856	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	85
PID 2668 wrote to memory of 2856	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	85
PID 2668 wrote to memory of 4960	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	87
PID 2668 wrote to memory of 4960	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	87
PID 2668 wrote to memory of 4960	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	87
PID 2668 wrote to memory of 4792	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	88
PID 2668 wrote to memory of 4792	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	88
PID 2668 wrote to memory of 4792	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	88
PID 2668 wrote to memory of 1200	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	89
PID 2668 wrote to memory of 1200	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	89
PID 2668 wrote to memory of 1200	2668	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe	89

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe

C:\Users\Admin\AppData\Local\Temp\dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe
"C:\Users\Admin\AppData\Local\Temp\dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2668
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4296
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1844
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3476
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2856
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4960
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4792
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 874d8acee578ea2b6bc76b2dce864bef30198d4a8f11ebe49372cd5c51c8874e
MD5 6e3ca1b2de0dc35ec0b1ea0936246c16
SHA1 527aebd6152b47305fc172cd3f2085a3b1f82493
SHA512 9dc4879ae495e9aeea820d2f3146044604e99d689c527fa41243fcce24102f33a20ece38b550034606450fbd0d6f003a6911c5743537a6dbaf9c046185c03cc0
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTLRsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutNLOaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 e7ff2b28b5e4c9d68f26cb6db3df0779c97ac3b71e03ec555a832af355bec857
MD5 00db3fd0ebfaa0200df4cde2f58c2c72
SHA1 78ba557c0436b60a4c92859109982de8391f6c7f
SHA512 07bdc30644424b23c9dfa13b070209f78a22bfd06cde6228498c3e536e599af6798a81b3c467095cfb98f7c1d8ac8e2e771a6d208488f70d605e540f5b787120
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTDRsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutNDOaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 37531aa72badba8d48723f09f7c89565fdee80d3c363c0ad5f0a02bb121757a3
MD5 5d760e01579b704a6d10a92a299d2235
SHA1 c8311a1b1f728adccf92c9ef409e0efa10ffd1b4
SHA512 39202fddb9abdb9ba73b1b4167627cf052a20ba6894754164c5dc8ae75a1161d42fe39dfa759d1c89a93ec365ef82fbf4b6a9613acfa1a79aebe3c6632dd5548
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTURsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutNUOaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 72cfe3537c71b61218dd97c69044e3942e07fbb7bfd93e5533fa8956bfbabb25
MD5 6b36cd18f90d1b249477f782747ba8b9
SHA1 f0193c404ccf6d8769650a130bd7c04994715d66
SHA512 5359fd53c97be086791ec2e2970d9058c4430230e0f7ac95a001cbc1c07761a2eccf381e31d365137a4a70e57972cf597df120f89122753628f6be5350975cc3
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTtRsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutNtOaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 91KB
SHA256 dd6c9a8045da52d61a2ff855e3432f4ef72863dd367f20410fcd12949192556e
MD5 7115016190bd18b9033384e133486351
SHA1 c421e3a01d36d2caccfc4dae05e4294b3f6c2edf
SHA512 a07ca85790def168d44a5a9db4a7fe763304fa9c9e4461479c264a0ac9a2a7f07b90051ca2c519e51739336a8a4edbd89b78d246967c77838c365e17f89e02d3
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTdRsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutNdOaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 28709d21d8925aa605beca0cc59d60b54fcad8eb77d087cc1bfe32279cb581bd
MD5 34751c5f328499e3e8aca8c4170e4985
SHA1 873cb8a956657e6c5805a0f5539263876ca6ee60
SHA512 4667dc1b45ae5dfd94ab31f2e1fd28f421b36960a7b7af1273e20b9541f0f2e9a2b4da03648bb7d8bde8383affd188754a00cf6e8fd2ee83f6a9ba9844100109
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTIRsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutNIOaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 8c80b4b6d81d68fa5b7d1a8b4398e5b6e30a86eb7f15255566c116a858628140
MD5 2e2a3bd15f2734fe91cf54025e13b1b5
SHA1 f960305795cbbc56fc08f06d6bfe24347ed55e7a
SHA512 ab4a6a71c206a889004933b20cf2e411c5c889880b798184a3d65a0d835a08f9d2d3fe7373cbc143aca00783f6ec238f26300202897ef45c5eb16e00e1e249f5
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VT8Rsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutN8OaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 77e45fc6afaf7a397647f79d88b07c5642b9f55866d5d5dace2d67c02645261e
MD5 d5f8a1505a7470af9bdc425e635c8447
SHA1 7d7ca90a6027b1be54f854460348cfe0ba8df000
SHA512 0bc68f0fabd1f42464b1e07d88110cd2386ea82bac4d9c1e4ab9caae687a588ccaf508f748aaf7e2c8fb95d7a4156f6cd61f3d6b79ce7e91e1be0a53d8116d02
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTxaRsjdf1aM67v32Z9x5nouy8VT+W:EOaHv3YpoutNIOaHv3YpoutN+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1200-154-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1844-118-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1844-115-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2668-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2668-155-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2856-132-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3476-125-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4296-114-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4792-149-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4960-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4960-136-0x0000000000400000-0x000000000042F000-memory.dmp

Download