Analysis
- max time kernel
133s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 03:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe
Resource
win7-20240215-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe
- Size 91KB
- Sample240603-d29e8shf71
- SHA256 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2
- MD5 85f70a6306c2d11d6a9c5bf129cf9072
- SHA1 29f0498402ebeb2fb2a56260f97f01400f907e54
- SHA512 39b9b8bd33770ffa2d511879ffc507b21ba7874f731a1af108b3c21a0fc2192b9ab6a799111e633dcf13da21d3c883140a8281876336c851b821e93da493f59e
- SSDEEP 1536:8AwEmBj3EXHn4x+9a2SAwEmBj3EXHn4x+9aBm:8GmF3onW+M2SGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Detects executables built or packed with MPress PE compressor 19 IoCs
resource yara_rule behavioral2/memory/1976-0-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023426-8.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002342a-106.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4084-107-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4084-112-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002342e-113.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023430-120.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4140-119-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2544-122-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2544-125-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023431-127.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/1116-132-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023432-134.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/2472-138-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023433-140.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023434-147.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/2120-146-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1976-154-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1576-153-0x0000000000400000-0x000000000042E000-memory.dmp INDICATOR_EXE_Packed_MPress - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Disables use of System Restore points 1 TTPs
- Executes dropped EXE 7 IoCs
pid Process 4084 xk.exe 4140 IExplorer.exe 2544 WINLOGON.EXE 1116 CSRSS.EXE 2472 SERVICES.EXE 2120 LSASS.EXE 1576 SMSS.EXE - Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Mig2.scr c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe File opened for modification C:\Windows\SysWOW64\shell.exe c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe File created C:\Windows\SysWOW64\shell.exe c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe File created C:\Windows\SysWOW64\Mig2.scr c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe File created C:\Windows\SysWOW64\IExplorer.exe c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe File created C:\Windows\xk.exe c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\ c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 4084 xk.exe 4140 IExplorer.exe 2544 WINLOGON.EXE 1116 CSRSS.EXE 2472 SERVICES.EXE 2120 LSASS.EXE 1576 SMSS.EXE - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1976 wrote to memory of 4084 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 84 PID 1976 wrote to memory of 4084 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 84 PID 1976 wrote to memory of 4084 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 84 PID 1976 wrote to memory of 4140 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 85 PID 1976 wrote to memory of 4140 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 85 PID 1976 wrote to memory of 4140 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 85 PID 1976 wrote to memory of 2544 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 86 PID 1976 wrote to memory of 2544 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 86 PID 1976 wrote to memory of 2544 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 86 PID 1976 wrote to memory of 1116 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 87 PID 1976 wrote to memory of 1116 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 87 PID 1976 wrote to memory of 1116 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 87 PID 1976 wrote to memory of 2472 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 88 PID 1976 wrote to memory of 2472 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 88 PID 1976 wrote to memory of 2472 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 88 PID 1976 wrote to memory of 2120 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 89 PID 1976 wrote to memory of 2120 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 89 PID 1976 wrote to memory of 2120 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 89 PID 1976 wrote to memory of 1576 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 90 PID 1976 wrote to memory of 1576 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 90 PID 1976 wrote to memory of 1576 1976 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe 90 - System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe"C:\Users\Admin\AppData\Local\Temp\c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1976 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4084
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4140
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2544
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2120
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
- Size 91KB
- SHA256 6be80233d1947f05b58d79d9e1c4a2c5e41992f0cfc8f5cfea5b0f0a54a6084c
- MD5 dd5a9c3ffe764e1298451a65438348dd
- SHA1 a3e6d9f0be7aa81bf8a6d35fdfdd16acc46a878e
- SHA512 1fcbfa137acedcee0af031ad528ed05bdf6e939ca723cb55ce1701493c05d83dc3a63c28a483bda5f24bd1450319d54ed4e975a686ab0149f53cf88bf32a4130
- SSDEEP 1536:8AwEmBj3EXHn4x+9aNSAwEmBj3EXHn4x+9aBm:8GmF3onW+MNSGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
- Size 91KB
- SHA256 82942aba2d7b7aba1af380e42faa99a6f5949e94197371446eab93ea0a2a60b0
- MD5 b1bd931d5ee7a75cc9f2113a078ec949
- SHA1 910a05ef194e7df279c02a2ccb79849d62bbd8ef
- SHA512 867b44bca8a056479a90cfc11c25d6459b63d49764e16592d1af251c0f286c914d6ca4bd234de0276120ccade6328405bd83ca2c267043f8502349acb00df492
- SSDEEP 1536:8AwEmBj3EXHn4x+9a2SAwEmBj3EXHn4x+9aBm:8GmF3onW+M2SGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
- Size 91KB
- SHA256 30c5d17ed90db65d7b3e313f714ec66c2dd69ddf664fab3d881ecfb69186d0c3
- MD5 8a2af1ec6a23d02e4033dda7284e545a
- SHA1 ae0fff7223177bae180ea55b141425a1ffc5781e
- SHA512 43cda52038fac935ce4d1c69f5353d0845e129ff3c54a9528bc66625a7839d84a855441a96381ea4ba801029f8f4be7a27e05d25d45c88921fd2c8ecbfe2c104
- SSDEEP 1536:8AwEmBj3EXHn4x+9aISAwEmBj3EXHn4x+9aBm:8GmF3onW+MISGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
- Size 91KB
- SHA256 53a2c1d015ff4f3308cf9d275ef49175488baf8fae8418f2b35dcfae950480d7
- MD5 4fc396f8ec314ace285c6e99d8b82f7a
- SHA1 d3cdebee1cb41d2e94d6dfe8a8a2e4a1eb5c885a
- SHA512 d06f599049cc97dd5d313b2a9f6ddda86d5cc47b47b7902c45a881433f4c263576ca01be2cfbb39c9e52b00504075d650e4ba71d2f11f3f23b50fdb04b61b7db
- SSDEEP 1536:8AwEmBj3EXHn4x+9a41SAwEmBj3EXHn4x+9aBm:8GmF3onW+M41SGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
- Size 91KB
- SHA256 79b4ef84ca214193712fdb6c3ec69b16fbcf203111734b3ae89d8c5430f01548
- MD5 980ab345aac9c837de9af51c4acde98d
- SHA1 572a7a7a34056df7dd6527bc945acb8ef93724eb
- SHA512 b5682027c0fac73b7ff95c966bc1f7c902611ea25d430cdfab6c9f4d6c4813bf2f92cd1d7d753c0d20d9f15b4feb2be07c35df084d06b06c86f1bfcfff9ed2c5
- SSDEEP 1536:8AwEmBj3EXHn4x+9abSAwEmBj3EXHn4x+9aBm:8GmF3onW+MbSGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\winlogon.exe
- Size 91KB
- SHA256 c603aca2f299d926050489525f2a66c4c78b69f557c554f2064116bcb6f2e5c2
- MD5 85f70a6306c2d11d6a9c5bf129cf9072
- SHA1 29f0498402ebeb2fb2a56260f97f01400f907e54
- SHA512 39b9b8bd33770ffa2d511879ffc507b21ba7874f731a1af108b3c21a0fc2192b9ab6a799111e633dcf13da21d3c883140a8281876336c851b821e93da493f59e
- SSDEEP 1536:8AwEmBj3EXHn4x+9a2SAwEmBj3EXHn4x+9aBm:8GmF3onW+M2SGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\IExplorer.exe
- Size 91KB
- SHA256 60b2673c7101253f673724ff56ee6828430c522bd0937b774e9cf16d1748b614
- MD5 59e880ec32f9409c905ea7853d474dd2
- SHA1 869e3c663610697b96a43e4ce4d0bf9e825bf750
- SHA512 1bad7ff11aa76c19fb94fd2fb698181efa6848aa0ec072a0f6718399d593f1b0b1dc0197a7e5f75427abd3f5f1e3b41eebd84a4af587551dea87872863f71007
- SSDEEP 1536:8AwEmBj3EXHn4x+9a6SAwEmBj3EXHn4x+9aBm:8GmF3onW+M6SGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\xk.exe
- Size 91KB
- SHA256 fcbb00a244b96582d56fef8e7b7fff482f84f15d3f61c794524ec05b75abc85c
- MD5 4b3a6b6464b2442f33e4457fdf798bf5
- SHA1 cf732c32505da218ab3f5314a7d9933110e8b0ba
- SHA512 2ff4439703ae55256c5739663ccd2338eefdaa0eea5092796df2a25fcea4ba9cc1f65433381011f7160ad4f7381af9bb2a45658e773c20aebda7754bd68edce8
- SSDEEP 1536:8AwEmBj3EXHn4x+9a+SAwEmBj3EXHn4x+9aBm:8GmF3onW+M+SGmF3onW+MBm
- MD5 SHA1 SHA512 SSDEEP