f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Size 91KB
Sample240607-lca55sfc33
SHA256 f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d
MD5 abbf792c7836dbc86fe5e63264a24a88
SHA1 ca56aa8e544c27ba2e22c8480dfcbd6f8a4619d0
SHA512 a379a76d50ae421f3170d32f1ee69997ba43dfa73d5f8f5f01503bd52cb78049eef45988cfb5ce198b0b20403803f45056e26f14a55bf678d69978bb78619d7c
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjmRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9mOJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

UPX dump on OEP (original entry point) 18 IoCs

resource	yara_rule
behavioral2/memory/1072-0-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x00070000000233bf-8.dat	UPX
behavioral2/files/0x00070000000233c3-105.dat	UPX
behavioral2/memory/4120-108-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x00070000000233c7-114.dat	UPX
behavioral2/memory/4120-113-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x00070000000233c9-120.dat	UPX
behavioral2/memory/532-118-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/memory/2360-125-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x00070000000233ca-127.dat	UPX
behavioral2/memory/4108-132-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x00070000000233cb-134.dat	UPX
behavioral2/memory/2976-140-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/files/0x00070000000233cc-141.dat	UPX
behavioral2/files/0x00070000000233cd-146.dat	UPX
behavioral2/memory/4036-148-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/memory/4352-153-0x0000000000400000-0x000000000042F000-memory.dmp	UPX
behavioral2/memory/1072-154-0x0000000000400000-0x000000000042F000-memory.dmp	UPX

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
4120	xk.exe
532	IExplorer.exe
2360	WINLOGON.EXE
4108	CSRSS.EXE
2976	SERVICES.EXE
4036	LSASS.EXE
4352	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1072-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x00070000000233bf-8.dat	upx
behavioral2/files/0x00070000000233c3-105.dat	upx
behavioral2/memory/4120-108-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x00070000000233c7-114.dat	upx
behavioral2/memory/4120-113-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x00070000000233c9-120.dat	upx
behavioral2/memory/532-118-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/2360-125-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x00070000000233ca-127.dat	upx
behavioral2/memory/4108-132-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x00070000000233cb-134.dat	upx
behavioral2/memory/2976-140-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x00070000000233cc-141.dat	upx
behavioral2/files/0x00070000000233cd-146.dat	upx
behavioral2/memory/4036-148-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4352-153-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/1072-154-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IExplorer.exe	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
File created	C:\Windows\SysWOW64\shell.exe	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
File created	C:\Windows\SysWOW64\Mig2.scr	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xk.exe	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
File opened for modification	C:\Windows\xk.exe	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
4120	xk.exe
532	IExplorer.exe
2360	WINLOGON.EXE
4108	CSRSS.EXE
2976	SERVICES.EXE
4036	LSASS.EXE
4352	SMSS.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 4120	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	83
PID 1072 wrote to memory of 4120	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	83
PID 1072 wrote to memory of 4120	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	83
PID 1072 wrote to memory of 532	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	84
PID 1072 wrote to memory of 532	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	84
PID 1072 wrote to memory of 532	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	84
PID 1072 wrote to memory of 2360	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	85
PID 1072 wrote to memory of 2360	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	85
PID 1072 wrote to memory of 2360	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	85
PID 1072 wrote to memory of 4108	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	87
PID 1072 wrote to memory of 4108	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	87
PID 1072 wrote to memory of 4108	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	87
PID 1072 wrote to memory of 2976	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	89
PID 1072 wrote to memory of 2976	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	89
PID 1072 wrote to memory of 2976	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	89
PID 1072 wrote to memory of 4036	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	90
PID 1072 wrote to memory of 4036	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	90
PID 1072 wrote to memory of 4036	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	90
PID 1072 wrote to memory of 4352	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	91
PID 1072 wrote to memory of 4352	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	91
PID 1072 wrote to memory of 4352	1072	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe	91

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe

C:\Users\Admin\AppData\Local\Temp\f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe
"C:\Users\Admin\AppData\Local\Temp\f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1072
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4120
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:532
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2360
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4108
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2976
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4036
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 7723b718888cc897b712d578c84b7d6bb9685f2cc662adfdbe45ace7521ee24b
MD5 683637cc87d8cbe81e4f5e3cba90be33
SHA1 8ea4466b086cf0147fdb7ee5b3703b189516aff8
SHA512 d62b9a6133a66a08bfd6c64e0affef3e1b2409d4c4529149a344b87989698116fc17e105e5b01632e948a1ecc740e16a3d99c9a87cef51e99e107446a34ff1ce
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjPRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9POJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 428f1fc6f2c80f5e9a984679a633faa519ae09b189852f8823367ab74292b04c
MD5 7d1364385bce0435f75c99710fd35fbe
SHA1 bf385a92e638c53909e3725d7ab9d062a2856bdd
SHA512 958c4cb507454abb63d50452fb048a452fca695f97b61c5e69be8417cf3552723bed39edee97ea94eccc3d867695343dfa93c9baa132390024fc52c0b374e64a
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjHRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9HOJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 0bf81a11b826ce50292e53e6529a1d4882c31eed5838528976c8e8a10ec55385
MD5 1484b1759908f2eb009b44ae2a2db120
SHA1 6673e442fb7e1665d874444a24dcdd619ba9e5be
SHA512 ef2060d29b6bc28794355201b3b51c646d7372e7c29bdb40fa05e37f3e29c9370cb78e88646ff909c54e2f2efdc8cbde2e782112d6afa8d72a3368b22de0e427
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjXRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9XOJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 b0ed870238745c4c20f3816470fe4246f5cc6f3f03de42416b531093f7a380aa
MD5 08ac3fa127cff337c89d9e19764ae138
SHA1 e612e634c577b94aa037100d51a17bbce127951a
SHA512 bec6d44ebd3adf9c88750ccd856081a030f373b9c018461289cff681e5790055ed541cbe514eced475d3ea29965f928e1a22ba65d0ef6c8076aa05cb84b3949c
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjGRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9GOJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 948b77f4711d38d9f87c95115b748f89a5f16e1ebfeed5b54c886a2c050d5139
MD5 ae19ff87854e5f7f4b22c78bc1bf19af
SHA1 df95dbb94cd88ab04b4fc83ac8d73ca2ec613506
SHA512 a9aa71c79ba2cbbea2d1988eff199c42a1411820751554d9661764cbbef93ae0c23b2d64ee0643ab35000012eb3512a9118db828e2cddebefb1a39d2a6d8f398
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjMRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9MOJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 91KB
SHA256 f6ae45fa03172b20ade4de1042b4b0e5bf9fcac2b2f623d5da6df3d3ecab0a5d
MD5 abbf792c7836dbc86fe5e63264a24a88
SHA1 ca56aa8e544c27ba2e22c8480dfcbd6f8a4619d0
SHA512 a379a76d50ae421f3170d32f1ee69997ba43dfa73d5f8f5f01503bd52cb78049eef45988cfb5ce198b0b20403803f45056e26f14a55bf678d69978bb78619d7c
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjmRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9mOJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 e3b1e4a0e32e3ee2a4b04e0e842b87865970e2f90ad5859bcdce83e3e6031537
MD5 89a36abd9f1ee6ce87503f07dce91ed4
SHA1 8828d73f673be6214e5e9294d9951e6bcfb36950
SHA512 9a8b8a4d902014022b0899adf5afd51682649f8397f354d848e82626881727ff264acf1d851cda0b4bf79532ccc0d0b59857bda6f76eefc31637abeec0085af1
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjZRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9ZOJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 a79ede040c6429ce17f64b4f58612fee4195471dee4b02abf575bf553274de0e
MD5 1620e0ef29b31aa222fcb345fa338f50
SHA1 c6fc92bc20fa2354d041093d81a1f200b9fbfc34
SHA512 f6025fed9345d2d5d6a08f074540b3eb82db3dc2fc15390d4d74c24f548178694acedd6aedb52436d1f969ad7d9ef0829f52fc248156bfcd7a59004bdb45b151
SSDEEP 1536:XRsjdLaslqdBXvTUL0Hnouy8VjCRsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9COJKqsout9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-118-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1072-154-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1072-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2360-125-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2976-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4036-148-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4108-132-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4120-113-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4120-108-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4352-153-0x0000000000400000-0x000000000042F000-memory.dmp

Download