a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Size

91KB
MD5

27b0d082805df80e464ea4080726289b
SHA1

e4fb571cc62855c5325df088caa25fb263d33c83
SHA256

a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998
SHA512

9986a6bd518eb0caccbbb7160e9c61034927f506b65fc7b0a3f5a9e1be40cd44bead11c3c7d6a3580ec42dc407c865f884d933a69566877cb97bd236524ddb72
SSDEEP

1536:kRsjd3GR2Dxy387Lnouy8VTYRsjd3GR2Dxy387Lnouy8VTY:kOgUXoutNYOgUXoutNY

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2972	xk.exe
2836	IExplorer.exe
3004	WINLOGON.EXE
756	CSRSS.EXE
544	SERVICES.EXE
1892	LSASS.EXE
2504	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2552-1-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0007000000016abb-8.dat	upx
behavioral1/memory/2552-106-0x0000000002580000-0x00000000025AF000-memory.dmp	upx
behavioral1/files/0x0008000000016ce7-110.dat	upx
behavioral1/files/0x0006000000017486-116.dat	upx
behavioral1/memory/2972-115-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2836-123-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2836-127-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/3004-136-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000018663-134.dat	upx
behavioral1/files/0x0014000000018669-139.dat	upx
behavioral1/memory/3004-142-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x001100000001867a-151.dat	upx
behavioral1/memory/756-158-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018686-171.dat	upx
behavioral1/memory/544-166-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2552-173-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00050000000186e6-177.dat	upx
behavioral1/memory/1892-176-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2504-189-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2552-188-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
File created	C:\Windows\SysWOW64\shell.exe	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
File created	C:\Windows\SysWOW64\Mig2.scr	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
File created	C:\Windows\xk.exe	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
2972	xk.exe
2836	IExplorer.exe
3004	WINLOGON.EXE
756	CSRSS.EXE
544	SERVICES.EXE
1892	LSASS.EXE
2504	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2972	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	28
PID 2552 wrote to memory of 2972	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	28
PID 2552 wrote to memory of 2972	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	28
PID 2552 wrote to memory of 2972	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	28
PID 2552 wrote to memory of 2836	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	29
PID 2552 wrote to memory of 2836	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	29
PID 2552 wrote to memory of 2836	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	29
PID 2552 wrote to memory of 2836	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	29
PID 2552 wrote to memory of 3004	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	30
PID 2552 wrote to memory of 3004	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	30
PID 2552 wrote to memory of 3004	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	30
PID 2552 wrote to memory of 3004	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	30
PID 2552 wrote to memory of 756	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	31
PID 2552 wrote to memory of 756	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	31
PID 2552 wrote to memory of 756	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	31
PID 2552 wrote to memory of 756	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	31
PID 2552 wrote to memory of 544	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	32
PID 2552 wrote to memory of 544	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	32
PID 2552 wrote to memory of 544	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	32
PID 2552 wrote to memory of 544	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	32
PID 2552 wrote to memory of 1892	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	33
PID 2552 wrote to memory of 1892	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	33
PID 2552 wrote to memory of 1892	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	33
PID 2552 wrote to memory of 1892	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	33
PID 2552 wrote to memory of 2504	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	34
PID 2552 wrote to memory of 2504	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	34
PID 2552 wrote to memory of 2504	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	34
PID 2552 wrote to memory of 2504	2552	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe

C:\Users\Admin\AppData\Local\Temp\a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe
"C:\Users\Admin\AppData\Local\Temp\a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2552
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2972
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2836
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3004
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:756
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:544
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1892
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
485d97710bb2bad24f0ae774f677d168

SHA1
e6911b70a9966031c3d2b54435fdf3e1701fa852

SHA256
5b4c25ae23eec604ded3d58996a74662f37be75cee120750b4ea72509106de1b

SHA512
dd67369024c4050d9acc2ba03df91e9ee4b62b6cbbcbd787594965a8db1a31ba4412f6ab9f0b9c5b303555b18bb548f3deed52a566c9753808d5a9df98db1d99

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
8bd175370778e5cb4e8308e04f3e1aab

SHA1
6a826440357cbd4f64c6fc2be19bfaadeba84d8c

SHA256
e4c14aeb725814af723441c70e523ca5217fa071e807090144c8b0d67986fc42

SHA512
307b505aed0951df32e709aa4afea0a708dd6be7ae84279b3573e7e98231002bc9aa82e98ffebddb0d2bfcb642cd27ca9e066c37d53dfc08c03516468641ef7a

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
27b0d082805df80e464ea4080726289b

SHA1
e4fb571cc62855c5325df088caa25fb263d33c83

SHA256
a9786fef672a73d0e5dcd4f63cad47bea2f91adee625d48fd4ab74453623a998

SHA512
9986a6bd518eb0caccbbb7160e9c61034927f506b65fc7b0a3f5a9e1be40cd44bead11c3c7d6a3580ec42dc407c865f884d933a69566877cb97bd236524ddb72

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
4cca57f71e0b7c4e3bf50ac5167d9fa6

SHA1
61fd82206362365bcfdec42559e976d05c34417e

SHA256
a01005994cee0d7b623a948af5882560559d2e09dce0fd35e40245e4a7ddebc7

SHA512
f02e09ffbf567b12055c7fd3529543f3f8270313e58ffc35a9c9df11f0b9f6f55e41880b4b690953719ac71ee03604c0595e491e0590b0d065208e3e06bc4751

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
bd0bdabcc4f8865fe8b45918d0fa55eb

SHA1
0953e41deeda094d3410d706ae751de9e43656a0

SHA256
469f9da406151abbda9b2cb1f7e1a5376b6e4f2d84368423800a29a61d1fd3f5

SHA512
e0d44b40e2fa4cc5117a2d28af7735c11f7d4ea6e8910d45a5762fa1021a4b64103adfcd452ccb65c9eb0d3a8f4c3b17fdbdfa3432f275d46a1c9a4cc8c1d3c4

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
0e85bc3d1bfb1288e99036dd3b5092da

SHA1
ce06b22d913388efca8680ddad5b7f2cb160dfb5

SHA256
400fb861b7a0379011fb45940757ab8b68ff6dd46f20546ae215d859255046d9

SHA512
ddee3f10480e52f79af0d9e5f7b50a1c846f559cc93dbe192a2da1d2479a2b9285074e36afb454648ecbb70587d295949f050e8a2917b567f83e49ecd026a839

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
ba210d8ad4dcf0ca73d942c071a58178

SHA1
732f97d42b08dcd9cc9197053ac5490625efc2b4

SHA256
36826d13175226b14345a6c26f38cb700339700e74334519cd428cfadfcf9834

SHA512
a4d51eda3d15ad7e28bb56c3e147608f3fbc9c6d654485e64f51c39dcd47aa034d74cb60ffb569dc791fc0e0fdd8617fa62eee5445aeee89ec437df405271814

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
bf213c1e7b3b04e65c0e7b1eb49636c6

SHA1
d8528d47bc2d03ee510c9d6f1915657fa3f51385

SHA256
ba2924334ad544d8d696c0f11efd03eadf59273341fecd05e7535b6899c5b95e

SHA512
56e87c32c61e4ad3a81c364b97f76d2401e763faa0f492e3cadb24149d99bfbcd35ec91c85e63c80e3aa862f524c1bfdb79c974a9993b6a8aabd92414d307808

Download Submit
memory/544-166-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/756-158-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1892-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2504-189-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2552-173-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2552-148-0x0000000002580000-0x00000000025AF000-memory.dmp

Filesize
188KB

Download
memory/2552-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2552-111-0x0000000002580000-0x00000000025AF000-memory.dmp

Filesize
188KB

Download
memory/2552-160-0x0000000002580000-0x00000000025AF000-memory.dmp

Filesize
188KB

Download
memory/2552-106-0x0000000002580000-0x00000000025AF000-memory.dmp

Filesize
188KB

Download
memory/2552-135-0x0000000002580000-0x00000000025AF000-memory.dmp

Filesize
188KB

Download
memory/2552-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2836-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2836-123-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2972-115-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3004-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3004-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download