899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Size 91KB
Sample240603-3zbtmaef79
SHA256 899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7
MD5 24f6200a3719b2c0631a13dafdae6777
SHA1 6cf60e8efbf5216ce6ba5c6fd375f1f1ce2a9ba0
SHA512 08f83cc213c5f806df1c8fcb52f1edbe220a44121b6233e94e4d779c8b9e08c061240ff5c20472e58406974a7aff3117c7056ffc945bcc4e1a680c7d0377e3ac
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imun3gRYjXbUeHORIC4Z2:uT3OA3+KQsxfS42T3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
3236	xk.exe
680	IExplorer.exe
1628	WINLOGON.EXE
1404	CSRSS.EXE
4904	SERVICES.EXE
5020	LSASS.EXE
2496	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IExplorer.exe	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
File created	C:\Windows\SysWOW64\shell.exe	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
File created	C:\Windows\SysWOW64\Mig2.scr	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
File created	C:\Windows\xk.exe	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
3236	xk.exe
680	IExplorer.exe
1628	WINLOGON.EXE
1404	CSRSS.EXE
4904	SERVICES.EXE
5020	LSASS.EXE
2496	SMSS.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3236	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	84
PID 5072 wrote to memory of 3236	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	84
PID 5072 wrote to memory of 3236	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	84
PID 5072 wrote to memory of 680	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	85
PID 5072 wrote to memory of 680	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	85
PID 5072 wrote to memory of 680	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	85
PID 5072 wrote to memory of 1628	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	86
PID 5072 wrote to memory of 1628	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	86
PID 5072 wrote to memory of 1628	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	86
PID 5072 wrote to memory of 1404	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	87
PID 5072 wrote to memory of 1404	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	87
PID 5072 wrote to memory of 1404	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	87
PID 5072 wrote to memory of 4904	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	89
PID 5072 wrote to memory of 4904	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	89
PID 5072 wrote to memory of 4904	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	89
PID 5072 wrote to memory of 5020	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	90
PID 5072 wrote to memory of 5020	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	90
PID 5072 wrote to memory of 5020	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	90
PID 5072 wrote to memory of 2496	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	91
PID 5072 wrote to memory of 2496	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	91
PID 5072 wrote to memory of 2496	5072	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe	91

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe

C:\Users\Admin\AppData\Local\Temp\899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe
"C:\Users\Admin\AppData\Local\Temp\899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5072
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3236
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:680
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1628
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1404
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4904
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5020
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 f6e9dc0ffa99b4a3aac90d28703190767a16396fed4c491cede97122a03989cc
MD5 68e17aa8181d11ed8bdd50ab893f4244
SHA1 e03a872e515787380851eeabe23a665463274571
SHA512 44af1eae54c08f7fad7f34a2b0c26fe6a442df8777f8d3bea7f7f278eb50dfc21b838e43234ae45fcd19a1099e70800f60d6263d4b1065d10b15ea4cf8d2ffb7
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuF3gRYjXbUeHORIC4Z2:uT3OA3+KQsxfS4sT3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 8501f8f97530556cc431e32604111624b86026088cb85e0e8b76a571779ff613
MD5 c5b409ff10d762cc8c7b6d64a4b05b95
SHA1 a7e22fce1c38702a20ea0fb927ddec6dcaa39679
SHA512 b329afb55bbe6ef645a3ea3cf2feb59bc79400c9a0bdf51de0b969f3a9585a4d115d82e5b1c513069e6e79d3294986350d764d4518b938a0557bd1d6d1f8658a
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imub3gRYjXbUeHORIC4Z2:uT3OA3+KQsxfS46T3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 dbf69140b2ef61f22cba0009841cdfb83430857cd65fbc01a58a28716bce95ee
MD5 c718f443fd2a77293eec9ee5a7e00acd
SHA1 aacd47699cd49be97bce9b299fe20652a5350890
SHA512 ea0d41a0c40b691647183924173273379c74be9b6cf48d440cc365a9693a3993fc9624cc8302035efbdeadacf98abd7567a8ec5993c83fa99de47cf9e2f32ecf
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuS3gRYjXbUeHORIC4Z2:uT3OA3+KQsxfS4zT3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 91KB
SHA256 899ed7a535fe177cfb9eaf1ada1bfeca6cf441be8a1b20e3a40c59d38192edd7
MD5 24f6200a3719b2c0631a13dafdae6777
SHA1 6cf60e8efbf5216ce6ba5c6fd375f1f1ce2a9ba0
SHA512 08f83cc213c5f806df1c8fcb52f1edbe220a44121b6233e94e4d779c8b9e08c061240ff5c20472e58406974a7aff3117c7056ffc945bcc4e1a680c7d0377e3ac
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imun3gRYjXbUeHORIC4Z2:uT3OA3+KQsxfS42T3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 8c9c3e8ad13d03e6e58918d1b392f9b573458b2111d222b57d44ddcc4cfc1730
MD5 e610637b42cfe041e11e59d89dd89a4a
SHA1 31533bf21184da68ed292b3e97fdda0702387028
SHA512 78014b29fbe385129a9fa1c2bd388183a55b5532248bd2cf5bd5a6b14fc48ad3fc84da3b807567a3e6b083f3c265861b2d2c958ca463ffe3c6b21646061468eb
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu+3gRYjXbUeHORIC4Z2:uT3OA3+KQsxfS4XT3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Size 91KB
SHA256 6f992e064abbc39b879f9f0a3ad488bbf2a837b5fe1a280ea19b4a5083b40e69
MD5 89483ae6cd0809436cd69992742225e3
SHA1 f7c8bca4886ea4dce1648f1b81b1abe43363dabd
SHA512 c0853e9a0197ebdd6ddf94813755d11d122ec844d62f55261d43eb54326d5b8f88b27b78c9cf2dfb63f14412734e1e89f39715accd3839684537ea86b2943d92
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuJ3gRYjXbUeHORIC4Z2:uT3OA3+KQsxfS44T3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 9c2f58a46e01b1c907a67cac403bea5e5f89e736d295b220a6164a002b0f4b93
MD5 005ade7b2d378190089693b85bddfdca
SHA1 1c545c828842bb02af12bc1b407bd02bbaff86b4
SHA512 006be2ac2baae9adfc315f6274561cb90e95db1e5ed01c18276a23b370e42b41843a6edb95937ffd9b5a2f8fe833cb1b1e50e6f8c6deac762a5ab32b5029162f
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu/3gRYjXbUeHORIC4Z2:uT3OA3+KQsxfS46T3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 ad7686e9c19cf5c95775963810a64db529ada26099d15613fd3ced96c5a5bb04
MD5 5b8444c320cb7d1349a4ea12f645c06f
SHA1 c4d720c8a95a36dc961a4e8a6283b0c6ca1cb779
SHA512 9c5999c062e319c2f985364ac2b111d4a417723dfce1f716e8f7548189bb59cb4ac1dc7abb34f3d137e456d0bbfe577158085f0ecc8aeec376a7f8d134b757c6
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuae3gRYjXbUeHORIC4I:uT3OA3+KQsxfS4BkT3OA3+KQsxfS4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/680-130-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/680-124-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/680-125-0x00000000753A0000-0x00000000754FD000-memory.dmp

Download

memory/1404-152-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/1404-146-0x00000000753A0000-0x00000000754FD000-memory.dmp

Download

memory/1404-145-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1404-182-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1404-151-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1628-134-0x00000000753A0000-0x00000000754FD000-memory.dmp

Download

memory/1628-138-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2496-173-0x00000000753A0000-0x00000000754FD000-memory.dmp

Download

memory/2496-178-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3236-113-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3236-120-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3236-116-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3236-114-0x00000000753A0000-0x00000000754FD000-memory.dmp

Download

memory/3236-112-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4904-156-0x00000000753A0000-0x00000000754FD000-memory.dmp

Download

memory/4904-160-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5020-164-0x00000000753A0000-0x00000000754FD000-memory.dmp

Download

memory/5020-169-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5072-144-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/5072-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/5072-142-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/5072-5-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/5072-2-0x00000000753A0000-0x00000000754FD000-memory.dmp

Download

memory/5072-3-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5072-181-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/5072-180-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5072-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download