a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Size

45KB
MD5

22904bd5ed107f0892cb4b0d5fe7a45f
SHA1

dcec73652ff1c8d47b313ed00b37af93e9dc6751
SHA256

a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0
SHA512

09dfe38a23a61136d93e4d8dc45def9559f64334ed80cdd03ac8e01435cb21902f2789ad519677668fefe25f37b2c4c727058806cd525f8b7fc6cfe753026d8b
SSDEEP

768:xmFQj8rM9whcqet8Wfxd9Mmnfa+TAOBJgZiPGyilSniJO14ktp7DFK+5nER:zAwEmBZ04faWmtN4nic+6GR

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Detects executables built or packed with MPress PE compressor 23 IoCs

resource	yara_rule
behavioral1/memory/2928-0-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0007000000014415-8.dat	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0007000000014f41-108.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1932-112-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1932-114-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000015424-115.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2928-116-0x0000000003220000-0x000000000324E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2848-124-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000600000001562a-130.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1956-147-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000015c6f-167.dat	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000015c7f-180.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2928-185-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3036-186-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3036-181-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1624-175-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1624-169-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1240-160-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000015682-156.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1956-150-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000015678-144.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1608-137-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2848-127-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1932	xk.exe
2848	IExplorer.exe
1608	WINLOGON.EXE
1956	CSRSS.EXE
1240	SERVICES.EXE
1624	LSASS.EXE
3036	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
File created	C:\Windows\SysWOW64\shell.exe	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
File created	C:\Windows\SysWOW64\Mig2.scr	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
File created	C:\Windows\xk.exe	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
1932	xk.exe
2848	IExplorer.exe
1608	WINLOGON.EXE
1956	CSRSS.EXE
1240	SERVICES.EXE
1624	LSASS.EXE
3036	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1932	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	28
PID 2928 wrote to memory of 1932	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	28
PID 2928 wrote to memory of 1932	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	28
PID 2928 wrote to memory of 1932	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	28
PID 2928 wrote to memory of 2848	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	29
PID 2928 wrote to memory of 2848	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	29
PID 2928 wrote to memory of 2848	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	29
PID 2928 wrote to memory of 2848	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	29
PID 2928 wrote to memory of 1608	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	30
PID 2928 wrote to memory of 1608	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	30
PID 2928 wrote to memory of 1608	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	30
PID 2928 wrote to memory of 1608	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	30
PID 2928 wrote to memory of 1956	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	31
PID 2928 wrote to memory of 1956	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	31
PID 2928 wrote to memory of 1956	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	31
PID 2928 wrote to memory of 1956	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	31
PID 2928 wrote to memory of 1240	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	32
PID 2928 wrote to memory of 1240	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	32
PID 2928 wrote to memory of 1240	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	32
PID 2928 wrote to memory of 1240	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	32
PID 2928 wrote to memory of 1624	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	33
PID 2928 wrote to memory of 1624	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	33
PID 2928 wrote to memory of 1624	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	33
PID 2928 wrote to memory of 1624	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	33
PID 2928 wrote to memory of 3036	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	34
PID 2928 wrote to memory of 3036	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	34
PID 2928 wrote to memory of 3036	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	34
PID 2928 wrote to memory of 3036	2928	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe

C:\Users\Admin\AppData\Local\Temp\a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe
"C:\Users\Admin\AppData\Local\Temp\a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2928
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1932
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2848
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1608
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1956
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1240
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1624
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
45KB

MD5
2413ef38df7089a2183f9e8ce58ac711

SHA1
87b8d6d67ac8b93f9cf7dc2c01ded56466368d8e

SHA256
e8afa2ace522e65b1ba304478263503728521c1a1d9c603c2b04c26ee2c6cbbc

SHA512
d74eac0ff7f619b2fa74fbfcdf80c3c8ebe55ef623f4ba6a65c6a95173d0ba55df1b4528e2c0e4f29e62aae0efea639291420edd9e97e915e27ab91d02d32f52

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
45KB

MD5
da4c935cb355503c08213451366d9cb4

SHA1
a0ab7813ca71012735f634a628c84478bc99e948

SHA256
a8f9bb93dcd3c1f95ecdddbc2628fa92e95de5c276fdab197ad68a3ec395d72f

SHA512
b57d7a15569f851b8434631ed31a712dcc502b1cc052e57b223a65089f43fa0b88e7fb12a32ef724838ef2519d3aea59ac24c791cefb5edd780d5f5548fe3fe4

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
45KB

MD5
8a8ab2ba408fc1b11cb8a86aff39f13a

SHA1
1f0bb1f11cea570026e6737e7588d937af6e8119

SHA256
ee1dc77e6d863777586464c0a33cc35f4db4826534434fbda436a62f35ab5aaa

SHA512
307c238035821e448e716b49da2c0e841de791975514dec820e3e48597c12c196e68e76307894c1e8bb9d28b8900e00d20fb7399f37f830d20b516b29c5346e8

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
45KB

MD5
c5614480663cfe888c7dc5192736cfdb

SHA1
c6da2ec1cd4ca7d3ad913870d438d29d0f4f1437

SHA256
b06bc230f324c5cac0faac2ec857a68a97fdb8be886e9866cf297444c7dd4cdc

SHA512
44f335fa44636ea529f032163684110114b5ecf315563a9015cdad324e5ea45f5ab59401c4088ccde245284c7f19e954ae6f57267b384ee2259b48fe2af3d6a7

Download Submit
C:\Users\Admin\AppData\Local\services.exe

Filesize
45KB

MD5
22904bd5ed107f0892cb4b0d5fe7a45f

SHA1
dcec73652ff1c8d47b313ed00b37af93e9dc6751

SHA256
a4bddb2f0da1e64182d016c2a199d892e49d9ba1ffba7c8e387a3c45f0f864f0

SHA512
09dfe38a23a61136d93e4d8dc45def9559f64334ed80cdd03ac8e01435cb21902f2789ad519677668fefe25f37b2c4c727058806cd525f8b7fc6cfe753026d8b

Download Submit
C:\Windows\xk.exe

Filesize
45KB

MD5
a8dff4787cb6555978a5174de6aaf397

SHA1
5f1f4c5573edd65adff1890c7a4a97cf5f1b0df5

SHA256
5cac79ffd30a3aeb3f1fd7b84ddd4df48aa7054dd16328bae492ea22874dec17

SHA512
cd380fd8695cc47de0a264dd7536e4213e6bed3e3edd151e510034baaacfa72a6befd60ca6aae26a8b5f2a8f04e4e45e58eabd47e7d6e50df8ef8fb9f30f6eea

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
45KB

MD5
5ffdfa1a5d4910e34b476bf1dcd9a78c

SHA1
39af84240018624a86b5e40a18eef7b45a770952

SHA256
4bab48a37e812a3f16e247585ea2c594b809cc06c742e5568d16216ba13c1e6e

SHA512
890a94554a812f6761f17a1ae2f396724bc9280128b34e5166d7c0f74a5adcd0102c90d2a23c0ec807d2bb2d453cc4d085ac356e36cca399da93c2374f89d9ec

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
937777c451527bdecc3e8901dbc8a59b

SHA1
c1380fb423cb8894ed3ce63f251494f15f6cc216

SHA256
d2c7327d37b79d7ea71e33a6eeeab4d818c58bc1fae16fd4e0f0187ae603ec16

SHA512
faa4a948ab0f6067f4e16b99213e9ca188d50d01ef505465a639f8e53edf92f97ac4b6a5f61ae04c3cd99420d4b005b5fe4e382c06ab6da8d346ebc53e99612b

Download Submit
memory/1240-160-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1608-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1624-175-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1624-169-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1932-114-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1932-112-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1956-147-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1956-150-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2848-127-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2848-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2928-145-0x0000000003220000-0x000000000324E000-memory.dmp

Filesize
184KB

Download
memory/2928-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2928-168-0x0000000003220000-0x000000000324E000-memory.dmp

Filesize
184KB

Download
memory/2928-123-0x0000000003220000-0x000000000324E000-memory.dmp

Filesize
184KB

Download
memory/2928-109-0x0000000003220000-0x000000000324E000-memory.dmp

Filesize
184KB

Download
memory/2928-146-0x0000000003220000-0x000000000324E000-memory.dmp

Filesize
184KB

Download
memory/2928-116-0x0000000003220000-0x000000000324E000-memory.dmp

Filesize
184KB

Download
memory/2928-110-0x0000000003220000-0x000000000324E000-memory.dmp

Filesize
184KB

Download
memory/2928-185-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3036-181-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3036-186-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download