9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Size 45KB
Sample240604-a2jyssfh52
SHA256 9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae
MD5 675c0ecb442c782a6e0c29c1665988d4
SHA1 e5b110fe25824dc76726b966fb31dd6c9f44d47b
SHA512 b860154ded6595a0f057db0d7edd42ffe1400988f5c82ceb7f61500d5d3259ff726578f1153071f569c99053ac8ab2b2dda238c13d97540e204b4ede5b4c0bca
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEY:8AwEmBj3EXHn4x+9aY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Detects executables built or packed with MPress PE compressor 19 IoCs

resource	yara_rule
behavioral2/memory/3368-0-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023409-8.dat	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000700000002340d-106.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3472-114-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023411-113.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1084-115-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1084-122-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023413-120.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4412-124-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4412-129-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023414-128.dat	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023415-136.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/5096-135-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3148-141-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023416-143.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/852-147-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023417-149.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3484-154-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3368-155-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
3472	xk.exe
1084	IExplorer.exe
4412	WINLOGON.EXE
5096	CSRSS.EXE
3148	SERVICES.EXE
852	LSASS.EXE
3484	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
File created	C:\Windows\SysWOW64\shell.exe	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
File created	C:\Windows\SysWOW64\Mig2.scr	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
File created	C:\Windows\xk.exe	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
3472	xk.exe
1084	IExplorer.exe
4412	WINLOGON.EXE
5096	CSRSS.EXE
3148	SERVICES.EXE
852	LSASS.EXE
3484	SMSS.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3472	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	82
PID 3368 wrote to memory of 3472	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	82
PID 3368 wrote to memory of 3472	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	82
PID 3368 wrote to memory of 1084	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	83
PID 3368 wrote to memory of 1084	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	83
PID 3368 wrote to memory of 1084	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	83
PID 3368 wrote to memory of 4412	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	84
PID 3368 wrote to memory of 4412	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	84
PID 3368 wrote to memory of 4412	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	84
PID 3368 wrote to memory of 5096	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	85
PID 3368 wrote to memory of 5096	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	85
PID 3368 wrote to memory of 5096	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	85
PID 3368 wrote to memory of 3148	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	86
PID 3368 wrote to memory of 3148	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	86
PID 3368 wrote to memory of 3148	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	86
PID 3368 wrote to memory of 852	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	87
PID 3368 wrote to memory of 852	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	87
PID 3368 wrote to memory of 852	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	87
PID 3368 wrote to memory of 3484	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	88
PID 3368 wrote to memory of 3484	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	88
PID 3368 wrote to memory of 3484	3368	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe	88

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe

C:\Users\Admin\AppData\Local\Temp\9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe
"C:\Users\Admin\AppData\Local\Temp\9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3368
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3472
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1084
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4412
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5096
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3148
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:852
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 45KB
SHA256 015db5977135e0a20c106c7f1e4aee559acb250d25c46ff070916d20303f2797
MD5 fe669f94571892a6b2099fe6505b4ba1
SHA1 7d7bb40fda81be2e07eebeadb500ccff05215e08
SHA512 74ea81814a13991b3c37b5fc3b792f32db2d5efc698c8978c8ba2c00f4b337a4e2917c2ac1853dd0369039cd5b8a5350bea8120e799a79430e662a76be07dd1c
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEN3:8AwEmBj3EXHn4x+9aN3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 45KB
SHA256 056fa4fe6835849c7ad4b9912f190518dd1bf7a29ac2e16062b291cacdb5d300
MD5 8c2f500424286f04219384300e6a626e
SHA1 7d386977bf1c1ad31682bdb646d2852082a37458
SHA512 3f74e0168be06500bf426b67645ad46c462cfe9060e60ccdd44d3b2b3d12544871b4b519abc5b5d03bc1bbb3bf96c4274f989755bd7a74c7ec4920098809205c
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEr:8AwEmBj3EXHn4x+9ar
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 45KB
SHA256 4ae49ec6e1ced6381befbe1047215dc2f36714308c5726b8d6e6a3b586f7b1c1
MD5 43760b7f68dbe5420d69defe48559273
SHA1 a136815aad68f523e361b26618874f58b3b15e36
SHA512 0a8c8bceb05d85529c23d7d6b647c2ebda214ae6fc68ea669895416aaaf14f90ec042568d9cfcb37979cf7b6fe47886f2cb26802501d875ffe88d8009d67e8b8
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nE13V:8AwEmBj3EXHn4x+9a1F
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 45KB
SHA256 681dff800b992acf95ebfc49630a4857c6c8e5723ca8ea18c2389bde8f408e13
MD5 e99e219bafaa6a988c1b951cbc19aee4
SHA1 8ca8c992048035630f6580dd0a44476d37cf1e19
SHA512 8ede57a3fcd6bfce53dd5b7833d99d1e6be1ed3e0867f8465d0802a404f1f5742ad15ff5d2553c048e23d660154b6c6cca7c671abc6904ee495cfcc66e3ff09e
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEwk:8AwEmBj3EXHn4x+9al
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 45KB
SHA256 9bf3797618557a0bc3622b24cbf9d8c7cdea04397204c21a30ec310bbdff39ae
MD5 675c0ecb442c782a6e0c29c1665988d4
SHA1 e5b110fe25824dc76726b966fb31dd6c9f44d47b
SHA512 b860154ded6595a0f057db0d7edd42ffe1400988f5c82ceb7f61500d5d3259ff726578f1153071f569c99053ac8ab2b2dda238c13d97540e204b4ede5b4c0bca
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEY:8AwEmBj3EXHn4x+9aY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
Size 45KB
SHA256 471ead3dbc35504b80a467e081432313ea4c87953bdbe8cee822fe09f72644e1
MD5 196b826fcbb774586b839899f47a869e
SHA1 ac525ccc5df3c5ea5bd3941fcd71255f9d726faa
SHA512 2c772431056ed6686e6f80f2129a43e1c577f6ffa6d2eedad9d2274df023e2bb14ad35a02cf0af5f2901656de48fd3e107812f62008a1834a8c50250b522185e
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEJ:8AwEmBj3EXHn4x+9aJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 45KB
SHA256 fdcc932af6498c7109cdf8cead85c89de5c58023bb9da0d0854f15608a48f579
MD5 9194a75be1a781204973fe06f0813f4d
SHA1 af0ce537c661245a0fb1e5a2998f4e6700da436f
SHA512 a70952943a5a44e0c5b572614198a6ef0ed14ef293679acde39544d4843e9b5de7527ae5e72111a94b10ac7d1bc6d80bb7d9c9b5eda5e455b9cbb3d70bfa4535
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEd:8AwEmBj3EXHn4x+9ad
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 45KB
SHA256 216d6a36a76ce955ea071ab48c5bf7f85b06cab54b3a526d0071b86a60b13f79
MD5 6191d140d534d4f9a5b4fe98925a0793
SHA1 c41eee56812314a03e2263c90c600765970fa288
SHA512 3d544fd6cfed53c4a8ebf5ec6d534d02d11d055fb2d85509d26dea68ee98b8a65412f77dee34b55f8345dba2d424c325b8b50762249eabd11adb0e332303ba97
SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nE7:8AwEmBj3EXHn4x+9a7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/852-147-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1084-115-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1084-122-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3148-141-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3368-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3368-155-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3472-114-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3484-154-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4412-124-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4412-129-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5096-135-0x0000000000400000-0x000000000042E000-memory.dmp

Download