fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Size

91KB
MD5

4a5d76f9629bbeea9583b7715699dade
SHA1

12a3b4018f34ef48183421fb9d86af81dbde319e
SHA256

fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67
SHA512

555ad716d52cc39d32c2638791ad69e64a47175c8bb0749c887c5d88a0104ca748f49b13b3cb5cf2e63a85ab71cda9a963d4801a5a53adab8e1ebf718f785b10
SSDEEP

1536:zAwEmBZ04faWmtN4nic+6G5AwEmBZ04faWmtN4nic+6GU:zGms4Eton05Gms4Eton0U

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Detects executables built or packed with MPress PE compressor 23 IoCs

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0009000000013adc-8.dat	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0008000000014251-108.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2968-111-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2968-114-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000014a60-115.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2580-122-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2580-125-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2944-134-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2944-137-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2028-145-0x0000000001EC0000-0x0000000001EEE000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2584-148-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000014f57-149.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2028-158-0x0000000001EC0000-0x0000000001EEE000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2644-159-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2644-161-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000600000001507a-162.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2028-168-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2616-173-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0006000000015083-174.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2764-183-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2764-186-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2028-187-0x0000000000400000-0x000000000042E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2968	xk.exe
2580	IExplorer.exe
2944	WINLOGON.EXE
2584	CSRSS.EXE
2644	SERVICES.EXE
2616	LSASS.EXE
2764	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
File created	C:\Windows\SysWOW64\shell.exe	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
File created	C:\Windows\SysWOW64\Mig2.scr	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
File created	C:\Windows\xk.exe	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
2968	xk.exe
2580	IExplorer.exe
2944	WINLOGON.EXE
2584	CSRSS.EXE
2644	SERVICES.EXE
2616	LSASS.EXE
2764	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2968	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	28
PID 2028 wrote to memory of 2968	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	28
PID 2028 wrote to memory of 2968	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	28
PID 2028 wrote to memory of 2968	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	28
PID 2028 wrote to memory of 2580	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	29
PID 2028 wrote to memory of 2580	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	29
PID 2028 wrote to memory of 2580	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	29
PID 2028 wrote to memory of 2580	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	29
PID 2028 wrote to memory of 2944	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	30
PID 2028 wrote to memory of 2944	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	30
PID 2028 wrote to memory of 2944	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	30
PID 2028 wrote to memory of 2944	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	30
PID 2028 wrote to memory of 2584	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	31
PID 2028 wrote to memory of 2584	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	31
PID 2028 wrote to memory of 2584	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	31
PID 2028 wrote to memory of 2584	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	31
PID 2028 wrote to memory of 2644	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	32
PID 2028 wrote to memory of 2644	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	32
PID 2028 wrote to memory of 2644	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	32
PID 2028 wrote to memory of 2644	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	32
PID 2028 wrote to memory of 2616	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	33
PID 2028 wrote to memory of 2616	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	33
PID 2028 wrote to memory of 2616	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	33
PID 2028 wrote to memory of 2616	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	33
PID 2028 wrote to memory of 2764	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	34
PID 2028 wrote to memory of 2764	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	34
PID 2028 wrote to memory of 2764	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	34
PID 2028 wrote to memory of 2764	2028	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe

C:\Users\Admin\AppData\Local\Temp\fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe
"C:\Users\Admin\AppData\Local\Temp\fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2028
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2968
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2580
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2944
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2584
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2644
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2616
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\services.exe

Filesize
91KB

MD5
4a5d76f9629bbeea9583b7715699dade

SHA1
12a3b4018f34ef48183421fb9d86af81dbde319e

SHA256
fa9b6636003de4d9ecd4026cc9042d5b0c14d5110d66193f017ee6febb01fa67

SHA512
555ad716d52cc39d32c2638791ad69e64a47175c8bb0749c887c5d88a0104ca748f49b13b3cb5cf2e63a85ab71cda9a963d4801a5a53adab8e1ebf718f785b10

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
71721dc2dbc5205113055928a06bbdaf

SHA1
0ac166cb1e88175b3436efcce7d5dfb58d999705

SHA256
408f3eb0a5f30322e1bcbbb5b6f3d3a5de16678f1aca55335e5e3c6b51c572a6

SHA512
52d4aba09ca3f8d54f043fcf52c5dfe7e5aa79d6e8afea4aae9a00c54fcb73d39452415b2b3ca6c8d012be0fe5fee0178c97556a893fed17315db13f24cfba03

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
7e66569abdce6808cee377a423e76672

SHA1
e9fd4335251078bcda39eb9b35f492533711f395

SHA256
4746d5dc4a188fbc4b3f8abc46d2e05a0d61d85a723ae78d557b23ee12925871

SHA512
99e94a1a963087760295c54265addbb5aa3c014f6933e5e9b6b692befff897f6b7f50f732c0f2b06f735f9220d4d8c771cee74eb4a374866c9dfd302e1b53783

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
047bb79124eeea60c25d73b7d24f0924

SHA1
415bf7f39799c94712a73d6707ac6da88712c366

SHA256
10b932671c8a9257b7aca3828760cbff87830c3fcf8029c0f7f2e435716cb65b

SHA512
72b297c35534bd6c180aab6dad9ab5a3ee478a92cca56184a08a1e71eef59bb50dc7b214d246ed9e2332986811891a1a2f831ad021e7b4073b5a1c2ac6d5fbb2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
8b8509e0472221a1a31a9959928f2dbc

SHA1
1505dfce0476e4c210e807d01867da05464cf3f9

SHA256
8d944d659a51bbcbcd2336f9c80d2ac3e75433924db34abaac0912bbb4c2e5ee

SHA512
b647a77ecbbda0a6a46185e58f0d72237232b3b85143a6cbcdedca1dadfe014bfd3ed1ac1829aafc8f4f82e0034bd4d2d4d161c64f19eb103eba303422bc9833

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
fada88a93ffc0adf74d91f28d13f395e

SHA1
2b2f55d06d25aef7cd3b557c46f9dd9e40708b0a

SHA256
fc9e037b6a9e4e752a4f5e06035523ddb9db3af437f30323c486147d534bbf7d

SHA512
3f10f188bf72390c2077a122caa642d9826a4c1f780b6f1ca993de1715ae751a15fef534c1bb93bd65e178c6331da7fe95ad62093720b7949c0d2c0aef07d618

Download Submit
memory/2028-145-0x0000000001EC0000-0x0000000001EEE000-memory.dmp

Filesize
184KB

Download
memory/2028-168-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-187-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-170-0x0000000001EC0000-0x0000000001EEE000-memory.dmp

Filesize
184KB

Download
memory/2028-110-0x0000000001EC0000-0x0000000001EEE000-memory.dmp

Filesize
184KB

Download
memory/2028-158-0x0000000001EC0000-0x0000000001EEE000-memory.dmp

Filesize
184KB

Download
memory/2028-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-109-0x0000000001EC0000-0x0000000001EEE000-memory.dmp

Filesize
184KB

Download
memory/2580-125-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2580-122-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2584-148-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-173-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2644-159-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2644-161-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2764-183-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2764-186-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2944-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2944-134-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2968-114-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2968-111-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download