Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 05:16
Behavioral task
behavioral1
Sample
e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe
Resource
win10v2004-20240508-en
General
-
Target
e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe
-
Size
232KB
-
MD5
f717612ad8f03464e96f3a33d67e8c4f
-
SHA1
3ef4d9b8960f8909446541bde480f1edcd4149a8
-
SHA256
e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0
-
SHA512
1ceea7d191284209fc1ef01321139bc1455fa03eb91339ee6d15b419e32542148efa5ce52429a5a91facadd0a9221d108ee7822890b4933d40308ef4b46da378
-
SSDEEP
3072:k/5F/E7tEf0n+p+tYlpJH7iXQNgggHlxDZiYLK5Wpk0out9rOJKqsout9e:khF4ca+wWJH7igNgjdFKsvoS9MKqsoSU
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x0007000000015ae3-8.dat UPX behavioral1/files/0x0007000000015d61-108.dat UPX behavioral1/memory/2876-111-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2372-109-0x0000000000540000-0x0000000000570000-memory.dmp UPX behavioral1/memory/2876-114-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x0006000000015f23-115.dat UPX behavioral1/memory/2372-116-0x0000000000540000-0x0000000000570000-memory.dmp UPX behavioral1/memory/636-125-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x0006000000016013-126.dat UPX behavioral1/memory/2692-133-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2692-136-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x0006000000016122-137.dat UPX behavioral1/memory/2372-139-0x0000000000540000-0x0000000000570000-memory.dmp UPX behavioral1/memory/1944-147-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x00060000000161ee-148.dat UPX behavioral1/memory/2372-151-0x0000000000540000-0x0000000000570000-memory.dmp UPX behavioral1/memory/2372-150-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1820-159-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x00060000000163eb-160.dat UPX behavioral1/memory/2372-163-0x0000000000540000-0x0000000000570000-memory.dmp UPX behavioral1/memory/2228-170-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x00060000000164ec-171.dat UPX behavioral1/memory/1604-178-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2372-182-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1604-181-0x0000000000400000-0x0000000000430000-memory.dmp UPX -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 7 IoCs
pid Process 2876 xk.exe 636 IExplorer.exe 2692 WINLOGON.EXE 1944 CSRSS.EXE 1820 SERVICES.EXE 2228 LSASS.EXE 1604 SMSS.EXE -
Loads dropped DLL 12 IoCs
pid Process 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0007000000015ae3-8.dat upx behavioral1/files/0x0007000000015d61-108.dat upx behavioral1/memory/2876-111-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2372-109-0x0000000000540000-0x0000000000570000-memory.dmp upx behavioral1/memory/2876-114-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0006000000015f23-115.dat upx behavioral1/memory/2372-116-0x0000000000540000-0x0000000000570000-memory.dmp upx behavioral1/memory/636-125-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0006000000016013-126.dat upx behavioral1/memory/2692-133-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2692-136-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0006000000016122-137.dat upx behavioral1/memory/2372-139-0x0000000000540000-0x0000000000570000-memory.dmp upx behavioral1/memory/1944-147-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x00060000000161ee-148.dat upx behavioral1/memory/2372-151-0x0000000000540000-0x0000000000570000-memory.dmp upx behavioral1/memory/2372-150-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1820-159-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x00060000000163eb-160.dat upx behavioral1/memory/2372-163-0x0000000000540000-0x0000000000570000-memory.dmp upx behavioral1/memory/2228-170-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x00060000000164ec-171.dat upx behavioral1/memory/1604-178-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2372-182-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1604-181-0x0000000000400000-0x0000000000430000-memory.dmp upx -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell.exe e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe File created C:\Windows\SysWOW64\shell.exe e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe File created C:\Windows\SysWOW64\Mig2.scr e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe File created C:\Windows\SysWOW64\IExplorer.exe e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe File created C:\Windows\xk.exe e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\ e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 2876 xk.exe 636 IExplorer.exe 2692 WINLOGON.EXE 1944 CSRSS.EXE 1820 SERVICES.EXE 2228 LSASS.EXE 1604 SMSS.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2876 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 28 PID 2372 wrote to memory of 2876 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 28 PID 2372 wrote to memory of 2876 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 28 PID 2372 wrote to memory of 2876 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 28 PID 2372 wrote to memory of 636 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 29 PID 2372 wrote to memory of 636 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 29 PID 2372 wrote to memory of 636 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 29 PID 2372 wrote to memory of 636 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 29 PID 2372 wrote to memory of 2692 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 30 PID 2372 wrote to memory of 2692 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 30 PID 2372 wrote to memory of 2692 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 30 PID 2372 wrote to memory of 2692 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 30 PID 2372 wrote to memory of 1944 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 31 PID 2372 wrote to memory of 1944 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 31 PID 2372 wrote to memory of 1944 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 31 PID 2372 wrote to memory of 1944 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 31 PID 2372 wrote to memory of 1820 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 32 PID 2372 wrote to memory of 1820 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 32 PID 2372 wrote to memory of 1820 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 32 PID 2372 wrote to memory of 1820 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 32 PID 2372 wrote to memory of 2228 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 33 PID 2372 wrote to memory of 2228 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 33 PID 2372 wrote to memory of 2228 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 33 PID 2372 wrote to memory of 2228 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 33 PID 2372 wrote to memory of 1604 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 34 PID 2372 wrote to memory of 1604 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 34 PID 2372 wrote to memory of 1604 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 34 PID 2372 wrote to memory of 1604 2372 e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe 34 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe"C:\Users\Admin\AppData\Local\Temp\e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2372 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2876
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:636
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1820
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2228
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD5f717612ad8f03464e96f3a33d67e8c4f
SHA13ef4d9b8960f8909446541bde480f1edcd4149a8
SHA256e40cc8ec5a0e25706cc6f883356eca10e11186d6350ff55a177c096fe2dd6eb0
SHA5121ceea7d191284209fc1ef01321139bc1455fa03eb91339ee6d15b419e32542148efa5ce52429a5a91facadd0a9221d108ee7822890b4933d40308ef4b46da378
-
Filesize
232KB
MD5ffea8ff15b205a943c198e46fe63dd4d
SHA1ef98cf447b84fa8b4b356cd4eeeff7a0fd48172b
SHA256e541702d0d4ce981a5d1888442be4998d62ca8f4837a6e17258fc43f97f2daaf
SHA5121bf993572155172197dcf6665de1e0dc534afaddd190460918809bd8199f0715f809d25905cf0b3f6a43fc45b51d20aab4f396715a8da0d1494c5cc33253c33c
-
Filesize
232KB
MD5443975720576d9c5c27474c00fe074fe
SHA167a2e25054b8e03fbfc7c31723eb359fff2bde3e
SHA2566bc35a1770d75c8136a21dd63c01b28b97fe9a99d04eb616021bb7f1f9b8ce74
SHA5121d01d0007b81ab2df8a6d3b4d0a197d7748b466ee2f3eba8880d77e892faf59b152f3fc407b4e040e3a2516e807824303848c44dd03d179d7d8262c0eff304fc
-
Filesize
232KB
MD54d98aeea532beb7d14587a10ae9f2f61
SHA167e8ecb22c3b561ba31901322d4ddea6e44cf567
SHA256135955a821933d794aec595a451eae80355121baac3b26958a60b97cab683464
SHA512312f693cf450d00b4d32da4025da510f19a35fd88c36655abec2cc99700a4eb8a858f58761c93d10e35ea39240f1824485cd1aa98069cf861fec6c8c4302e245
-
Filesize
232KB
MD5ad591f38d9e9595bae90a502cabd19ae
SHA10e953f641b8dec2964d4a3ea4454b1eed065b001
SHA25607eb923e70957ec310d8f896c95c7d3d7d972206f8353f8341178cfab2246aec
SHA512820fe9b720460e78d459d896ae72e7fe37d4dfb8466b8141c7b8e620d3bf96a2d1c19adcf4c069e5afe852aec27c6ce454b68d98ad0d15e64c0e9b8817965ae8
-
Filesize
232KB
MD58e97a033098a938463c47ffd227133ce
SHA17c0b34cec53a71e02953259d91ffabe6dbf7ed90
SHA256ed00a740e3315a96800c2d240c14bc734e077a008800ff49b8e4625a3b912782
SHA512fdc9fbb12c29108b4fab1f54a5cdcaaaad7bbb3393a6990e08ade2102ea62bb84d4728f7cb2f15333d84970eba4cd66c33b9731399f0857933e9849dea3afd39
-
Filesize
232KB
MD50f4a62ffb6fed4afaea7cc1c8fde3c1d
SHA148f812dd7c51385659efbd15fefa1a4f2e60c1d1
SHA2565b0a1d38994ebf90e149494684ddc974b20a006bbb4b30c381e42cde11af15a9
SHA51283532c479b9ad1a3327505267f811194abc57328a917d3fcefe55eb18e0adf7bc55a9401c358ed89d387df7dab7f1d10e9a1544736802b4bcad8b9e3fa0526d8
-
Filesize
232KB
MD546a867e41ec8608553494cab4a9c4382
SHA1d7c4179369802b684a445f1654d04f232fa73bfe
SHA256edba4a832b0b72abdea5098cb6a8e16e7e528e9974d4b3ae8a879d1e3a621abe
SHA5125913cc239cd0c4da13100e00632342bf453da32ae0b83b640d53d4f2a6615f6cba65ae02b10f8b0c36165c6d18fa5ee14da898f79a27ab0020e80f4d4c73583b