c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Size

91KB
MD5

5ff3d33fb8eb97bd6b4c1339f3abe90c
SHA1

405995d75c25446677b2e55e9c592412b29c9415
SHA256

c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477
SHA512

7a8205ac9ccaaa8ca656dc4cd307176d4dde96732a075ffbd99d562d65f71882bd297f688c8b9f4c7aa40c283e5a9af8430323272cf46471e97efd28405759c7
SSDEEP

1536:FAwEmBGz1lNNqDaG0PoxhlzmeAwEmBGz1lNNqDaG0PoxhlzmY:FGmUXNQDaG0A8eGmUXNQDaG0A8Y

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Detects executables built or packed with MPress PE compressor 25 IoCs

resource	yara_rule
behavioral1/memory/620-0-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0008000000016d3b-8.dat	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0007000000016d68-109.dat	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0005000000018784-114.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/620-117-0x00000000025A0000-0x00000000025CE000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2520-116-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2808-125-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2808-129-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x00050000000187a2-137.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/620-136-0x00000000025A0000-0x00000000025CE000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000018b73-140.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/748-143-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000018bc6-158.dat	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000018bda-168.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2116-167-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2116-165-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1568-155-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1568-153-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/620-151-0x00000000025A0000-0x00000000025CE000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/264-178-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/620-177-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/264-180-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x00060000000190d6-187.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/620-193-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2828-191-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2520	xk.exe
2808	IExplorer.exe
748	WINLOGON.EXE
1568	CSRSS.EXE
2116	SERVICES.EXE
264	LSASS.EXE
2828	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
File created	C:\Windows\SysWOW64\shell.exe	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
File created	C:\Windows\SysWOW64\Mig2.scr	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
File created	C:\Windows\xk.exe	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
2520	xk.exe
2808	IExplorer.exe
748	WINLOGON.EXE
1568	CSRSS.EXE
2116	SERVICES.EXE
264	LSASS.EXE
2828	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 2520	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	28
PID 620 wrote to memory of 2520	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	28
PID 620 wrote to memory of 2520	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	28
PID 620 wrote to memory of 2520	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	28
PID 620 wrote to memory of 2808	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	29
PID 620 wrote to memory of 2808	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	29
PID 620 wrote to memory of 2808	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	29
PID 620 wrote to memory of 2808	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	29
PID 620 wrote to memory of 748	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	30
PID 620 wrote to memory of 748	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	30
PID 620 wrote to memory of 748	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	30
PID 620 wrote to memory of 748	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	30
PID 620 wrote to memory of 1568	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	31
PID 620 wrote to memory of 1568	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	31
PID 620 wrote to memory of 1568	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	31
PID 620 wrote to memory of 1568	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	31
PID 620 wrote to memory of 2116	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	32
PID 620 wrote to memory of 2116	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	32
PID 620 wrote to memory of 2116	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	32
PID 620 wrote to memory of 2116	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	32
PID 620 wrote to memory of 264	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	33
PID 620 wrote to memory of 264	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	33
PID 620 wrote to memory of 264	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	33
PID 620 wrote to memory of 264	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	33
PID 620 wrote to memory of 2828	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	34
PID 620 wrote to memory of 2828	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	34
PID 620 wrote to memory of 2828	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	34
PID 620 wrote to memory of 2828	620	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe

C:\Users\Admin\AppData\Local\Temp\c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe
"C:\Users\Admin\AppData\Local\Temp\c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:620
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2520
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2808
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:748
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1568
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2116
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:264
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
1a0d83c5df73aadca91bcd95d24fcd01

SHA1
dfdfe4ec013f464b087656cb306633db9d227579

SHA256
3596bdde7f599fa4b79880d39ceb07c494261c92c5159a442fb69b1ba3353f60

SHA512
5a361db272b575aec6d5c41582635f5badeb10b58e89c36f8265586e3c638b2f8abcc8286749b8fc7e6c60ab1dbc99e3116e6756945b5a3d65c312c8c53f7729

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
ee030293ed09c5a6c77bd29f2d518335

SHA1
73fc6008be9cee580f5f5504311816be519036c0

SHA256
62af0c672473f471db35471725082ac1ae6c079e26ddb6ff14f9a48036621578

SHA512
5b7585c936f48ce6e592af9f32ac0327a31aa5680afc073076090d9af2e4a599b896d4aba326d6aeaa28b8b5b65da8c8f6e3f00f1e295789608f4ca629b4e336

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
5ff3d33fb8eb97bd6b4c1339f3abe90c

SHA1
405995d75c25446677b2e55e9c592412b29c9415

SHA256
c64c43fa5b69985ed5e11b889e8a03663aa2bf2a0321cdb411ba034fd0a01477

SHA512
7a8205ac9ccaaa8ca656dc4cd307176d4dde96732a075ffbd99d562d65f71882bd297f688c8b9f4c7aa40c283e5a9af8430323272cf46471e97efd28405759c7

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
67893ab31e70cc9ac8ddd7deceb9b560

SHA1
2a33128f130354284cb0f637f97106f29815dbb9

SHA256
474e38dbb46cb9d9adf1002f434e52dd645c394724dbb92c2ef4bc1b7d5fdb39

SHA512
5bb5015bc7fcd46b5814355069454d01845bf7b9235b99c1f5f322e104a28d78b4b74ce976d908e319743137a66cdcc5cbfcde22ff8ddab4f9f06bf3ae90034a

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
e1cfd33956ac2327a97cd6286ce54142

SHA1
2d192af93bd123e119493c74039bf54a092cc85a

SHA256
e620bd8dd0106d6f0ef37b18d35659e0085e5dd7eca4084b16597881766de79c

SHA512
1a7671c29fdf45b9640783d388179d5efbc8f1b3ccaa71ee07b25c502d3ee8016519f1546d5727ab8234d30ce0b07cf3c7cfd7611d7965d221bd51d272237812

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
59a2e07f6e4d2f5fe64d9f0b8a4cce03

SHA1
1e02ae41f28ed9566d6bdee38446bfdb5a18ad22

SHA256
f93c72d5b2700720f7ee4fd8e9fbc74d9206cefb3567347182c39654088f1e28

SHA512
a4c6711b18facaa08f8982e3942e7b3ce14f247a394fd6ebf0d9c18609caeb8eba8405946faaabfdd5016349748be974c35dcc5b837f5987179d65c5b19da73f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
564429b35f4f93f68c2aa1d52e75dd75

SHA1
b75d8092d8cd8bf07cf4aaaa2e299b8ade8e9298

SHA256
cb4598320963884c4fe5c1ddbc28dbe45c59503f92c0a5d5c55be2b71174f003

SHA512
e27386800c552cf2299fb17222df219a356d10b57e9016c879a22fe90dc71c4ae13a597fcb9f1246c408f73ae541db5ec3fc082ade6084ce3fd26a3646f4cd8f

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
2da7866fda3fc879af6112ac9bbb0c96

SHA1
b9f1d85c8a99558ef90330cc1065920f9f1eb117

SHA256
97651e2ef14b247890942105810478a740e39a67d5624b2a3824a65759d7493b

SHA512
9cb23f405dbfdc559cdf346e98241d8ded6aee27320bc9b10d83e008d88972c02b1a8e3b78bd8591fe886e209e7b1b30a948edf2898596e166f51f6c65d3e861

Download Submit
memory/264-180-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/264-178-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/620-124-0x00000000025A0000-0x00000000025CE000-memory.dmp

Filesize
184KB

Download
memory/620-193-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/620-117-0x00000000025A0000-0x00000000025CE000-memory.dmp

Filesize
184KB

Download
memory/620-136-0x00000000025A0000-0x00000000025CE000-memory.dmp

Filesize
184KB

Download
memory/620-152-0x00000000025A0000-0x00000000025CE000-memory.dmp

Filesize
184KB

Download
memory/620-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/620-110-0x00000000025A0000-0x00000000025CE000-memory.dmp

Filesize
184KB

Download
memory/620-111-0x00000000025A0000-0x00000000025CE000-memory.dmp

Filesize
184KB

Download
memory/620-177-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/620-151-0x00000000025A0000-0x00000000025CE000-memory.dmp

Filesize
184KB

Download
memory/748-143-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1568-153-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1568-155-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2116-165-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2116-167-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2520-116-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2808-129-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2808-125-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2828-191-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download