ardamax | 8f9c4fc3f5b138a15cd755f7fea03a9c4bcaedc31a0c80f3300a1e8b8ad27c0c

Analysis

max time kernel
146s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LH ULT.exe
Size

1.8MB
MD5

9370f3c5c9d3c39b2c1d9fc7be45ec43
SHA1

4640456dd0e891f0a3671147fb5e841b16132c9f
SHA256

59775e1d0a558fbeab5be94e59872dbd790ec9d71cd8df541bf5f385ee1cffb3
SHA512

bf375e5ecefa9a57c4630f7dbd39f98dab20e498f7e40d53389a3979559e31d669055190a92a9ccc3c27efc38ef4128369402959d83b50533f9758cc98f6f3bd
SSDEEP

24576:xOOc3veWFazdRci6TJo5UrDRB5Gu4zlIsjGZqVY0gc8p:0e6azduiWo5UrDHEnRjEqXYp

Score

10^/10

ardamax discovery evasion keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023407-33.dat	family_ardamax

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	LH ULT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Wyd Program.exe

Executes dropped EXE 3 IoCs

pid	Process
3456	Wyd Program.exe
220	LH-ULT.exe
5188	LPDW.exe

Loads dropped DLL 7 IoCs

pid	Process
3456	Wyd Program.exe
5188	LPDW.exe
220	LH-ULT.exe
5188	LPDW.exe
5188	LPDW.exe
220	LH-ULT.exe
220	LH-ULT.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LPDW Agent = "C:\\Windows\\SysWOW64\\28463\\LPDW.exe"	LPDW.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\LPDW.007	Wyd Program.exe
File created	C:\Windows\SysWOW64\28463\LPDW.exe	Wyd Program.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Wyd Program.exe
File opened for modification	C:\Windows\SysWOW64\28463	LPDW.exe
File created	C:\Windows\SysWOW64\28463\LPDW.001	Wyd Program.exe
File created	C:\Windows\SysWOW64\28463\LPDW.006	Wyd Program.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 30 IoCs

evasion

pid	Process
3360	taskkill.exe
4076	taskkill.exe
4508	taskkill.exe
2052	taskkill.exe
3112	taskkill.exe
2788	taskkill.exe
4544	taskkill.exe
552	taskkill.exe
208	taskkill.exe
2932	taskkill.exe
4776	taskkill.exe
4536	taskkill.exe
4592	taskkill.exe
1560	taskkill.exe
4864	taskkill.exe
4664	taskkill.exe
3924	taskkill.exe
4564	taskkill.exe
2268	taskkill.exe
840	taskkill.exe
3672	taskkill.exe
1148	taskkill.exe
1388	taskkill.exe
3424	taskkill.exe
728	taskkill.exe
3660	taskkill.exe
2696	taskkill.exe
3084	taskkill.exe
4344	taskkill.exe
3748	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	rundll32.exe

Modifies registry key 1 TTPs 22 IoCs

Modify Registry

T1112

pid	Process
6024	reg.exe
3856	reg.exe
4312	reg.exe
5544	reg.exe
1752	reg.exe
5488	reg.exe
5500	reg.exe
1808	reg.exe
4352	reg.exe
1376	reg.exe
5180	reg.exe
5488	reg.exe
2568	reg.exe
5576	reg.exe
1756	reg.exe
3364	reg.exe
5392	reg.exe
5532	reg.exe
2244	reg.exe
4172	reg.exe
4016	reg.exe
2940	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe
220	LH-ULT.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	3672	taskkill.exe
Token: SeDebugPrivilege	220	LH-ULT.exe
Token: SeDebugPrivilege	4544	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: 33	5188	LPDW.exe
Token: SeIncBasePriorityPrivilege	5188	LPDW.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	3112	taskkill.exe
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	840	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	2932	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	1388	taskkill.exe
Token: SeDebugPrivilege	208	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	3660	taskkill.exe
Token: SeDebugPrivilege	728	taskkill.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeDebugPrivilege	3748	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	4864	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1496	LH ULT.exe
5188	LPDW.exe
5188	LPDW.exe
5188	LPDW.exe
5188	LPDW.exe
5188	LPDW.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4508	1496	LH ULT.exe	81
PID 1496 wrote to memory of 4508	1496	LH ULT.exe	81
PID 1496 wrote to memory of 4508	1496	LH ULT.exe	81
PID 1496 wrote to memory of 4564	1496	LH ULT.exe	82
PID 1496 wrote to memory of 4564	1496	LH ULT.exe	82
PID 1496 wrote to memory of 4564	1496	LH ULT.exe	82
PID 1496 wrote to memory of 3508	1496	LH ULT.exe	83
PID 1496 wrote to memory of 3508	1496	LH ULT.exe	83
PID 1496 wrote to memory of 3508	1496	LH ULT.exe	83
PID 1496 wrote to memory of 4544	1496	LH ULT.exe	84
PID 1496 wrote to memory of 4544	1496	LH ULT.exe	84
PID 1496 wrote to memory of 4544	1496	LH ULT.exe	84
PID 1496 wrote to memory of 4664	1496	LH ULT.exe	86
PID 1496 wrote to memory of 4664	1496	LH ULT.exe	86
PID 1496 wrote to memory of 4664	1496	LH ULT.exe	86
PID 1496 wrote to memory of 2052	1496	LH ULT.exe	87
PID 1496 wrote to memory of 2052	1496	LH ULT.exe	87
PID 1496 wrote to memory of 2052	1496	LH ULT.exe	87
PID 1496 wrote to memory of 4776	1496	LH ULT.exe	88
PID 1496 wrote to memory of 4776	1496	LH ULT.exe	88
PID 1496 wrote to memory of 4776	1496	LH ULT.exe	88
PID 1496 wrote to memory of 3360	1496	LH ULT.exe	89
PID 1496 wrote to memory of 3360	1496	LH ULT.exe	89
PID 1496 wrote to memory of 3360	1496	LH ULT.exe	89
PID 1496 wrote to memory of 3084	1496	LH ULT.exe	91
PID 1496 wrote to memory of 3084	1496	LH ULT.exe	91
PID 1496 wrote to memory of 3084	1496	LH ULT.exe	91
PID 1496 wrote to memory of 3388	1496	LH ULT.exe	92
PID 1496 wrote to memory of 3388	1496	LH ULT.exe	92
PID 1496 wrote to memory of 3388	1496	LH ULT.exe	92
PID 1496 wrote to memory of 2696	1496	LH ULT.exe	93
PID 1496 wrote to memory of 2696	1496	LH ULT.exe	93
PID 1496 wrote to memory of 2696	1496	LH ULT.exe	93
PID 1496 wrote to memory of 3672	1496	LH ULT.exe	94
PID 1496 wrote to memory of 3672	1496	LH ULT.exe	94
PID 1496 wrote to memory of 3672	1496	LH ULT.exe	94
PID 1496 wrote to memory of 4864	1496	LH ULT.exe	95
PID 1496 wrote to memory of 4864	1496	LH ULT.exe	95
PID 1496 wrote to memory of 4864	1496	LH ULT.exe	95
PID 1496 wrote to memory of 2268	1496	LH ULT.exe	97
PID 1496 wrote to memory of 2268	1496	LH ULT.exe	97
PID 1496 wrote to memory of 2268	1496	LH ULT.exe	97
PID 1496 wrote to memory of 2932	1496	LH ULT.exe	98
PID 1496 wrote to memory of 2932	1496	LH ULT.exe	98
PID 1496 wrote to memory of 2932	1496	LH ULT.exe	98
PID 1496 wrote to memory of 1560	1496	LH ULT.exe	99
PID 1496 wrote to memory of 1560	1496	LH ULT.exe	99
PID 1496 wrote to memory of 1560	1496	LH ULT.exe	99
PID 1496 wrote to memory of 2788	1496	LH ULT.exe	100
PID 1496 wrote to memory of 2788	1496	LH ULT.exe	100
PID 1496 wrote to memory of 2788	1496	LH ULT.exe	100
PID 1496 wrote to memory of 916	1496	LH ULT.exe	101
PID 1496 wrote to memory of 916	1496	LH ULT.exe	101
PID 1496 wrote to memory of 916	1496	LH ULT.exe	101
PID 1496 wrote to memory of 4948	1496	LH ULT.exe	102
PID 1496 wrote to memory of 4948	1496	LH ULT.exe	102
PID 1496 wrote to memory of 4948	1496	LH ULT.exe	102
PID 1496 wrote to memory of 1200	1496	LH ULT.exe	103
PID 1496 wrote to memory of 1200	1496	LH ULT.exe	103
PID 1496 wrote to memory of 1200	1496	LH ULT.exe	103
PID 1496 wrote to memory of 1056	1496	LH ULT.exe	104
PID 1496 wrote to memory of 1056	1496	LH ULT.exe	104
PID 1496 wrote to memory of 1056	1496	LH ULT.exe	104
PID 1496 wrote to memory of 4352	1496	LH ULT.exe	105

C:\Users\Admin\AppData\Local\Temp\LH ULT.exe
"C:\Users\Admin\AppData\Local\Temp\LH ULT.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im egui.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ekrn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "Panda anti-virus service"
  2⤵
  PID:3508
- - C:\Windows\SysWOW64\net.exe
    net stop "Panda anti-virus service"
    3⤵
    PID:5540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Panda anti-virus service"
      4⤵
      PID:5564
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ApVxdWin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im AVENGINE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im pavsrv51.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im psimreal.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im PsImSvc.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im WebProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
    3⤵
    - Modifies registry key
    PID:5544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcagent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcdash.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mghtml.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcmnhdlr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcvsshld.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im McVSEscn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcvsftsn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
  2⤵
  PID:916
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
    3⤵
    - Modifies registry key
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
    3⤵
    - Modifies registry key
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
    3⤵
    - Modifies registry key
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
  2⤵
  PID:1056
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
    3⤵
    - Modifies registry key
    PID:5180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
    3⤵
    - Modifies registry key
    PID:5488
- C:\Users\Admin\AppData\Local\Temp\Wyd Program.exe
  "C:\Users\Admin\AppData\Local\Temp\Wyd Program.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:3456
- - C:\Windows\SysWOW64\28463\LPDW.exe
    "C:\Windows\system32\28463\LPDW.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
    3⤵
    - Disables RegEdit via registry modification
    - Modifies registry key
    PID:6024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
  2⤵
  PID:2556
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:1808
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im egui.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ekrn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "Panda anti-virus service"
  2⤵
  PID:4756
- - C:\Windows\SysWOW64\net.exe
    net stop "Panda anti-virus service"
    3⤵
    PID:5572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Panda anti-virus service"
      4⤵
      PID:4944
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ApVxdWin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im AVENGINE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im pavsrv51.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im psimreal.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im PsImSvc.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im WebProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
  2⤵
  PID:3100
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
    3⤵
    - Modifies registry key
    PID:4172
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcagent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcdash.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mghtml.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcmnhdlr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcvsshld.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im McVSEscn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mcvsftsn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
  2⤵
  PID:3096
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
    3⤵
    - Modifies registry key
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
  2⤵
  PID:3476
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
    3⤵
    - Modifies registry key
    PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
  2⤵
  PID:1444
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
    3⤵
    - Modifies registry key
    PID:5576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
    3⤵
    - Modifies registry key
    PID:3856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
  2⤵
  PID:2192
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
    3⤵
    - Modifies registry key
    PID:2244
- C:\Users\Admin\AppData\Local\Temp\LH-ULT.exe
  "C:\Users\Admin\AppData\Local\Temp\LH-ULT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
  2⤵
  PID:900
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:5392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
  2⤵
  PID:64
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:1752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
  2⤵
  PID:4476
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:2568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\LH ULT.exe"
1⤵
- Modifies registry class
PID:3628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\LH ULT.exe"
1⤵
- Modifies registry class
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@6283.tmp

Filesize
4KB

MD5
c3679c3ff636d1a6b8c65323540da371

SHA1
d184758721a426467b687bec2a4acc80fe44c6f8

SHA256
d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb

SHA512
494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\LH-ULT.exe

Filesize
1.3MB

MD5
ed28101b599887489e72ac28dc891004

SHA1
6a4f46e7e005480e158fd6677fc3d71d6e8b70e4

SHA256
c713c5eec297bbdb4c9ca1ba3a70a8bb37117c55f34623b940ffef99c54a8b89

SHA512
f19317c0a12ffac7ae423373cb131a0f4dfa027225ce6e5807ba37aeb780765b86603278b826c5fe7488eab4c5061ae0ff4e57c1af07b196d3ce306d3c55204c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wyd Program.exe

Filesize
481KB

MD5
2dcaea385c0c2243f745ad1a82b57df2

SHA1
96ec8053d4bf9c0b2a908c04281ee431b0cb79cb

SHA256
e3ce5e9fba31007ec3c5708564b9bf9cfb235175f1d9a5c357a7eb4631b92201

SHA512
600c415f47b24fdd9af8e0c7226d80cb059967c1a54981f21324d59528b14a9739f060d2d2430ab0b183bda22be56baec62d66123af64bdd48c06edaa0d6fc5f

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
395KB

MD5
b8fa30233794772b8b76b4b1d91c7321

SHA1
0cf9561be2528944285e536f41d502be24c3aa87

SHA256
14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a

SHA512
10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d

Download Submit
C:\Windows\SysWOW64\28463\LPDW.001

Filesize
496B

MD5
16e638c938fe51d8add6181dad4a2a64

SHA1
d115fe021da975acc2502a9246d6ebf3c7484ebd

SHA256
d5918fb9f8eb1764e2027b53aedab4a3f2cf59b0b3b3dd149cec8a40ae173038

SHA512
51ac60f8d4576f3082e4999a14216bb2f2f4b2e7f1539c3080ebe871cbb838a219c1f933cdfa637afc1ae9ec3daa7a2188a5572cae8991b50ed63a048e84725d

Download Submit
C:\Windows\SysWOW64\28463\LPDW.006

Filesize
8KB

MD5
43f02e9974b1477c1e6388882f233db0

SHA1
f3e27b231193f8d5b2e1b09d05ae3a62795cf339

SHA256
3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba

SHA512
e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

Download Submit
C:\Windows\SysWOW64\28463\LPDW.007

Filesize
5KB

MD5
b5a87d630436f958c6e1d82d15f98f96

SHA1
d3ff5e92198d4df0f98a918071aca53550bf1cff

SHA256
a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2

SHA512
fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

Download Submit
C:\Windows\SysWOW64\28463\LPDW.exe

Filesize
473KB

MD5
17535dddecf8cb1efdba1f1952126547

SHA1
a862a9a3eb6c201751be1038537522a5281ea6cb

SHA256
1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd

SHA512
b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

Download Submit
memory/220-48-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/220-51-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/220-52-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download