f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Size

91KB
MD5

4b238c4ed158caf57bd841e6e01fe58e
SHA1

672eebc4969ad292dcaaaf9cf38acad5b7bff3ca
SHA256

f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc
SHA512

61f91b17778009807b3acdaf5591277169ea71e1e674eaf1530dea3c2778b11a2c226658d577d77776fa63c990b0faf7cc59eea55b0b32ff1cba4cb17a1f1bc3
SSDEEP

768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuXrk3gRYjXbUeHORICH:uT3OA3+KQsxfS4dT3OA3+KQsxfS4mV

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1352	xk.exe
1368	IExplorer.exe
340	WINLOGON.EXE
328	CSRSS.EXE
2044	SERVICES.EXE
2748	LSASS.EXE
1836	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mig2.scr	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
File created	C:\Windows\SysWOW64\shell.exe	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
File created	C:\Windows\xk.exe	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
1352	xk.exe
1368	IExplorer.exe
340	WINLOGON.EXE
328	CSRSS.EXE
2044	SERVICES.EXE
2748	LSASS.EXE
1836	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1352	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	28
PID 2252 wrote to memory of 1352	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	28
PID 2252 wrote to memory of 1352	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	28
PID 2252 wrote to memory of 1352	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	28
PID 2252 wrote to memory of 1368	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	29
PID 2252 wrote to memory of 1368	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	29
PID 2252 wrote to memory of 1368	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	29
PID 2252 wrote to memory of 1368	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	29
PID 2252 wrote to memory of 340	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	30
PID 2252 wrote to memory of 340	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	30
PID 2252 wrote to memory of 340	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	30
PID 2252 wrote to memory of 340	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	30
PID 2252 wrote to memory of 328	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	31
PID 2252 wrote to memory of 328	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	31
PID 2252 wrote to memory of 328	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	31
PID 2252 wrote to memory of 328	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	31
PID 2252 wrote to memory of 2044	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	32
PID 2252 wrote to memory of 2044	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	32
PID 2252 wrote to memory of 2044	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	32
PID 2252 wrote to memory of 2044	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	32
PID 2252 wrote to memory of 2748	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	33
PID 2252 wrote to memory of 2748	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	33
PID 2252 wrote to memory of 2748	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	33
PID 2252 wrote to memory of 2748	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	33
PID 2252 wrote to memory of 1836	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	34
PID 2252 wrote to memory of 1836	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	34
PID 2252 wrote to memory of 1836	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	34
PID 2252 wrote to memory of 1836	2252	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe

C:\Users\Admin\AppData\Local\Temp\f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe
"C:\Users\Admin\AppData\Local\Temp\f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2252
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1352
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1368
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:340
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:328
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2044
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2748
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
d57d6723abe4193d8eb014c48c551bde

SHA1
78ae5d8f23de62f22f56a6145a781f52652932b0

SHA256
a2bb2ab927628e93afd78a399cdb3232950aca0fffa9dc0b3f260544bafd4f61

SHA512
59f583fdf71656b412a34d7dac4654b9a7bef2afa1b825c908939e2c7090e96ec428df98bc588444fd03c227574b046f759cb554363b872774e74e38b7bacf66

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
dd80551ae212530460d3dcf15a0d958c

SHA1
64e3863d1ee8512f9030495953822f1cf90d2884

SHA256
e674a2681874d8c41233199f360401433f0f202436f788ec82dda6930ad531b9

SHA512
01207ae6f0dc99f2ebdf9b762bc4e33e5b59cbe7834baf385e9c8d96bd0f26bb721ff8bab1a7265df352247fd988417066505f3aa60f569aefd808a3903b9eda

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
3fbff637f5381e6c59258c7e7e543eb5

SHA1
c67c25ab87d9ef28ddb316701b8b830860839cac

SHA256
37be75b2cd7490828aaafbe5d88273c9155a4c10c9f1b5eb6dae1acb89189bc2

SHA512
b06bbfa2e0aba478aec9b6479c9bcc19c33d323baf59191b62fa86b30594801e73a0c9ad71efdf4212827eda50f9f990e8386c5a3ef2c15692b513059be13565

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
f520d6d7feb42b405037e5022b6e58ff

SHA1
c1b87432e7279f36a2468a2766e35ab373583ca2

SHA256
e221fff7a97ac1f7a035d556fc8f9980e2e0f4dbea4bade7498b1d7e6b2e112f

SHA512
c661f159fe126fb67ecb66ca287775235f2f19c4de62ac14043ca201a1356d6b04536a48a76e21a5f645f50f81eb8e1d140d7ed131ac06d6ee55564cf58f5193

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
4b238c4ed158caf57bd841e6e01fe58e

SHA1
672eebc4969ad292dcaaaf9cf38acad5b7bff3ca

SHA256
f49ecadbde3754574457ef20665f5984b4c889336c049303b63c28ceaddac5cc

SHA512
61f91b17778009807b3acdaf5591277169ea71e1e674eaf1530dea3c2778b11a2c226658d577d77776fa63c990b0faf7cc59eea55b0b32ff1cba4cb17a1f1bc3

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
9e0378edb9d7b624d03c590c79eb09ea

SHA1
99ad8d751e13d1a008ba03184ed96c293bc25d97

SHA256
7261e85a9802b8ca3126c4fdd93175a7d79732c55c42452a6dcd8fb7a5572b56

SHA512
1452f042a4735a00e4bc02e9f41be97ef2890e6ad2949d04be3a764fb03036d48385b4eba518829c2fcf484305493ee242d74cd8b5c53e8e6e7471eeb9a8ea88

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
22ddd6e80518f800b60fa646707b3a7e

SHA1
180cbb79ce490e3394ae0c4472a09358db56e21b

SHA256
b10a84f74f8afdd68206b0c2b9fb8f9a768f4a321bc716b8f9247527c409344d

SHA512
cd43302b7c311782b91543f8706070d1ec22ac814e9e572807bec1587deb63f8e7a61968872d2b14a62a036eee7d901b1b719b71ffc6db47d7a5815e82ec468b

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
9cd6c6d5b35b3c047ad2cdde883479c5

SHA1
0a7eb2a6601426e92ae66e7c66bde0b486514b60

SHA256
f3040b42c04cf3fe7b093420e5366c5bdcd7770388ad8bbd34cbd6537b5b15ea

SHA512
9e432829f7e1a906ff08812966977a74a5d2c3efb69a0ad95f223c6be4a5890e2530dc75ee0fdfef16831800fdb3ae4503ae44091e15b0b84859ad81e15407a7

Download Submit
memory/328-170-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/328-166-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/340-156-0x0000000000401000-0x0000000000427000-memory.dmp

Filesize
152KB

Download
memory/340-148-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/340-155-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/340-147-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/340-149-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1352-119-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1352-116-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1352-117-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1352-122-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1368-133-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1368-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1368-138-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1368-132-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1836-214-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1836-207-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1836-208-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2044-183-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2044-179-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2044-185-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2252-124-0x0000000003210000-0x000000000323C000-memory.dmp

Filesize
176KB

Download
memory/2252-146-0x0000000003210000-0x000000000323C000-memory.dmp

Filesize
176KB

Download
memory/2252-114-0x0000000003210000-0x000000000323C000-memory.dmp

Filesize
176KB

Download
memory/2252-215-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2252-216-0x0000000000401000-0x0000000000427000-memory.dmp

Filesize
152KB

Download
memory/2252-193-0x0000000003210000-0x000000000323C000-memory.dmp

Filesize
176KB

Download
memory/2252-164-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2252-165-0x0000000000401000-0x0000000000427000-memory.dmp

Filesize
152KB

Download
memory/2252-150-0x0000000003210000-0x000000000323C000-memory.dmp

Filesize
176KB

Download
memory/2252-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2252-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2252-115-0x0000000003210000-0x000000000323C000-memory.dmp

Filesize
176KB

Download
memory/2252-4-0x0000000000401000-0x0000000000427000-memory.dmp

Filesize
152KB

Download
memory/2252-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2252-131-0x0000000003210000-0x000000000323C000-memory.dmp

Filesize
176KB

Download
memory/2252-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2748-199-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2748-194-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download