6fb537b8af964cd320bd7e7bba534ae4af3b8aedf5fc0a388b12f2ef27adf9a0

Analysis

max time kernel
119s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01e04c58ed14a215b0b20487ba941810N.exe
Size

170KB
MD5

01e04c58ed14a215b0b20487ba941810
SHA1

ce42fdf609059e8ad2b9841e621c1748de007f01
SHA256

6fb537b8af964cd320bd7e7bba534ae4af3b8aedf5fc0a388b12f2ef27adf9a0
SHA512

0a1983a99e7f7794fcd035ce5eacb1f44ad3f3b437d9d954bcff8ce2d9f981674dc3cf906090e8b11538005eddb16ffd0d49b21a00816fc8467599634fd3faf8
SSDEEP

3072:WCcKpzOpm3uKQCDWeyDKVPy7THK4WZZzUR9Lr0lQbX:H7zOSuccuVqfp2+Se

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\\YQX7J5Q.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\\YQX7J5Q.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002340e-147.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	01e04c58ed14a215b0b20487ba941810N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 5 IoCs

pid	Process
1940	service.exe
4572	smss.exe
4516	system.exe
3152	winlogon.exe
4752	lsass.exe

Loads dropped DLL 1 IoCs

pid	Process
4516	system.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002340e-147.dat	upx
behavioral2/memory/4516-322-0x0000000010000000-0x0000000010075000-memory.dmp	upx
behavioral2/memory/4516-336-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sVE8P1U0 = "C:\\Windows\\system32\\DVU4E0WXEN3J3I.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0J5QEN = "C:\\Windows\\RUH8P1U.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sVE8P1U0 = "C:\\Windows\\system32\\DVU4E0WXEN3J3I.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0J5QEN = "C:\\Windows\\RUH8P1U.exe"	system.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\Y:	service.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\KIM8R7F.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\KIM8R7F.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\KIM8R7F.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C	smss.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C	service.exe
File opened for modification	C:\Windows\SysWOW64\KIM8R7F.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C	system.exe
File opened for modification	C:\Windows\SysWOW64\TKM0P1C	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\DVU4E0WXEN3J3I.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\KIM8R7F.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\KIM8R7F.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\lsass.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\XEN3J3I.exe	system.exe
File opened for modification	C:\Windows\RUH8P1U.exe	winlogon.exe
File created	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	smss.exe
File opened for modification	C:\Windows\RUH8P1U.exe	smss.exe
File created	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\zia01212	system.exe
File opened for modification	C:\Windows\moonlight.dll	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\YQX7J5Q.exe	smss.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\moonlight.dll	winlogon.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\RUH8P1U.exe	system.exe
File opened for modification	C:\Windows\XEN3J3I.exe	smss.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\YQX7J5Q.exe	service.exe
File opened for modification	C:\Windows\XEN3J3I.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	winlogon.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	service.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	system.exe
File opened for modification	C:\Windows\lsass.exe	winlogon.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\ORO8S6L.com	system.exe
File created	C:\Windows\MooNlight.R.txt	smss.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\ORO8S6L.com	lsass.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\cypreg.dll	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\ORO8S6L.com	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\RUH8P1U.exe	service.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	system.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}	lsass.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\YQX7J5Q.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\RUH8P1U.exe	01e04c58ed14a215b0b20487ba941810N.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	winlogon.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	system.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\moonlight.dll	service.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	smss.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	winlogon.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\YQX7J5Q.exe	lsass.exe
File opened for modification	C:\Windows\XEN3J3I.exe	lsass.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	service.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\ORO8S6L.com	service.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\ORO8S6L.com	smss.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	winlogon.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	lsass.exe
File opened for modification	C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01e04c58ed14a215b0b20487ba941810N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	01e04c58ed14a215b0b20487ba941810N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	lsass.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	4516	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4836	01e04c58ed14a215b0b20487ba941810N.exe
1940	service.exe
4572	smss.exe
3152	winlogon.exe
4516	system.exe
4752	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1940	4836	01e04c58ed14a215b0b20487ba941810N.exe	85
PID 4836 wrote to memory of 1940	4836	01e04c58ed14a215b0b20487ba941810N.exe	85
PID 4836 wrote to memory of 1940	4836	01e04c58ed14a215b0b20487ba941810N.exe	85
PID 4836 wrote to memory of 4572	4836	01e04c58ed14a215b0b20487ba941810N.exe	87
PID 4836 wrote to memory of 4572	4836	01e04c58ed14a215b0b20487ba941810N.exe	87
PID 4836 wrote to memory of 4572	4836	01e04c58ed14a215b0b20487ba941810N.exe	87
PID 4836 wrote to memory of 4516	4836	01e04c58ed14a215b0b20487ba941810N.exe	88
PID 4836 wrote to memory of 4516	4836	01e04c58ed14a215b0b20487ba941810N.exe	88
PID 4836 wrote to memory of 4516	4836	01e04c58ed14a215b0b20487ba941810N.exe	88
PID 4836 wrote to memory of 3152	4836	01e04c58ed14a215b0b20487ba941810N.exe	89
PID 4836 wrote to memory of 3152	4836	01e04c58ed14a215b0b20487ba941810N.exe	89
PID 4836 wrote to memory of 3152	4836	01e04c58ed14a215b0b20487ba941810N.exe	89
PID 4836 wrote to memory of 4752	4836	01e04c58ed14a215b0b20487ba941810N.exe	90
PID 4836 wrote to memory of 4752	4836	01e04c58ed14a215b0b20487ba941810N.exe	90
PID 4836 wrote to memory of 4752	4836	01e04c58ed14a215b0b20487ba941810N.exe	90

C:\Users\Admin\AppData\Local\Temp\01e04c58ed14a215b0b20487ba941810N.exe
"C:\Users\Admin\AppData\Local\Temp\01e04c58ed14a215b0b20487ba941810N.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
  "C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1940
- C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
  "C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4572
- C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
  "C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4516
- C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
  "C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3152
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Music\My Music.exe

Filesize
170KB

MD5
a8c867d65c0bddbc97463817e03bb881

SHA1
611caa1f548b080862a5e24dca6e9d6b67ef5698

SHA256
b353de90735da4836d278d5a891d66065b6cd41d5b0543f079d44e3c069794a4

SHA512
41efa9687edae010419a1ca2b257d7737dc4dde68c98b0551d25d1c01e7e5a84484f865b867dac9395a4478c2a73aa347f0017cea4c85489ced6c094765b964b

Download Submit
C:\Users\Admin\Pictures\My Pictures.exe

Filesize
170KB

MD5
36466c37499a53086eab8580b883841b

SHA1
88477943f796ca13533b607fe56c08953b3cdd52

SHA256
d4c6d3b89dbd885c5e53bc37704eb2cba2bf7f669977ed7bf1b7a89f5f0ece56

SHA512
6fb30c2bcdcbf684237549d94523902bb80a7e116e975869c912ab8568f2a729a13c9aff688ab8c4a642bea84b53c722120e1b2346556dee111031ea64f0409d

Download Submit
C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\YQX7J5Q.exe

Filesize
170KB

MD5
c2783a217cccfff8a9877d7cded4a483

SHA1
b7089ebbcb3e2350290e6f80650f252b3a627bee

SHA256
37153ded4020e20c8683b6a92631409282c892f0a2612fbc9b66c8410602ec81

SHA512
3517d156a71b7bcfe6cd4a6caaaca59958db64e149f6c4514ecde32ac3d90db2c9cfc831b48dd419150ca8a37077ca505027945cc28378ac797222d82f6a742b

Download Submit
C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\YQX7J5Q.exe

Filesize
170KB

MD5
27ef503d257798f3f873576a90d08af0

SHA1
38bdc1777542542e435b31373045ef4d9272d29e

SHA256
557ad13b5b86659aef105527cec41e330f5dec1f24ae6f996b2db8e3f0f419ae

SHA512
5e2c66ab68d2e5ed9c5cc6c35df034292eb2804a50d87ca8589a92e005c96864783e2c17bd55a033bce84d50fa5c78e458652119bb1a827da04444b1be3e1855

Download Submit
C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\YQX7J5Q.exe

Filesize
170KB

MD5
758263bba066eeb32a1d40728c087e10

SHA1
cd786e9a50fb5039a7842cc4fc4923bcc117e27c

SHA256
bcc7817baf5612c3113ac98ac47141c9881c8a230a6883c1ef5be6032db0211c

SHA512
8ed4f1729b303ff82012b8404e3101d109bc459e0d82c7e8591afb86691dc86e4e7bd600845c7ca1f944c1b6e14f062ccad44be53e27a45ea964d9414c4f023e

Download Submit
C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
170KB

MD5
b1c77b48c756ae991e8a712bbab3cbd5

SHA1
181d326cf9a010bbbd8c9de5cf4369cd09e921b4

SHA256
f710e20734452faee4ad1170e1024eaa0e3917019abcb85d867e96688d7da3c5

SHA512
5b3c336a1a1deb7ce590d8f7960d0ab87ffcf72284bf4c756ef2b6c7f8e515cbc29f28ca3debacf846cb4930c6a1a4fd43edab2b22ad5025b4035373fe96fe77

Download Submit
C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
170KB

MD5
c4029f2b47715f97d74b132270572105

SHA1
c63eb0e888821c02a3f0567f0218dd56e701744b

SHA256
179a623174d9492ca9eeb9772b8b4ae088f0d80655536afc26562e3bc32c32ac

SHA512
e57c48d35930e21baf407414efae2b7795a24b79d8489fe8326efb333a0c3a3b03f4e95eedcd57c7656eb10b5d120ab5f057cc004a3d561691d4b0665b447651

Download Submit
C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
170KB

MD5
a0f5b18e0a4c6e17802369b8eef39c4b

SHA1
834497ca089194e2029b25944a872659bdfd78c6

SHA256
d514a521e7da3843521a25049eebbe117fb2a255272ad3797b89210cb3b4e659

SHA512
54a5a78c26100ecaeb8ecfa1bd39990d59a14d9175ea118dc77c41646ba02e92802af5fa446503dbecd2355ccfc0c6402de45dc8637695d8e65e4239b40c90f3

Download Submit
C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
170KB

MD5
c977287fb54b1049e6240931c942ebc8

SHA1
442c091d78d5ba6feed07ab1b98592cc5a91fdd3

SHA256
de2117843b21d766edb6deb57f8783ffb5880a8996150e080a5ed0ab784e8d6f

SHA512
b110b34a4fae0540eca697dd62e45db936d79cbee4558216e76074d63292a7c3778f203b35ba049d7a18694f6d8696e27be853b93aace3f389802ada61bc9a2e

Download Submit
C:\Windows\PVE5F8Q.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
170KB

MD5
4ff0da8e77cd7f7f68644a879aedf503

SHA1
8fa03c86917d7efb2d662cd1a1cdb5615d731eb6

SHA256
1da8fb27810cf7dfef15042ac8d50c4cc17e70a413da98d44a85e6de5e580ca1

SHA512
6f95174446c14eadf8146e9b3547caefef61a47211002e25550fb6ab9339cfcf7076720552f60d21386c698963b5c0f58c96f6e8d58c5756ca2f56a496cc7330

Download Submit
C:\Windows\RUH8P1U.exe

Filesize
170KB

MD5
fdeec705db630f805fce90fc1d8f16d3

SHA1
fd26aaa287d451285f8f30edbfc4405b6097e4cc

SHA256
227e96577c70bd4cbbf151df8bb1711a10df888378df331e93f2233215881ef3

SHA512
bb4ad817567b17350d8cba131811fc8b96aa5c7ae89f643ee137c76054aaf66ba9b44022276f9378a790fdc1f9e0eb88529da3ce61dffff6ad60755fae4f13f7

Download Submit
C:\Windows\SysWOW64\KIM8R7F.exe

Filesize
170KB

MD5
b03a9f81644957b74e7124af61fadeb9

SHA1
b5f360d3fddd7f845bf50273d023dc331e5ec96b

SHA256
3123fd7ee2107592358736abb2b2cce0bbb282d300460fc0a485eb3f72879cd0

SHA512
a8870c34afb99a3145cc46a6478dfc735d62269c5f16cd4473af6d2a50d304883b2afc8465f5271d401c16816c7b68788310fb5b1e54010285f118e98e738162

Download Submit
C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd

Filesize
170KB

MD5
4fbf3061c70398c457c1c9940f252153

SHA1
d62e42175c47ea690a1a8c0916e94f02e5a97754

SHA256
fd46e5b29be8cdfb36a825d8941f6aa0a4a3a28f954c604ffd60abc248603978

SHA512
28d62049c435c5f945511d4b4d32c2063a03fde27dbc249597d26e2918bf73a5c63b78894d6fc2bb065b11801bdad788e6ab17f800b461b1d7fb808a3ee32b5c

Download Submit
C:\Windows\SysWOW64\TKM0P1C\DVU4E0W.cmd

Filesize
170KB

MD5
ba8306bb068d76bb13a64b1e9fbaf30d

SHA1
052f365d009429983590865ea9a462507b890a5f

SHA256
b3dd1029e9ec2e5d6fe2be7df8d9d4c2074bcc658693b9b2c51b6f32f436b84b

SHA512
05b6b13898d8e29eb5fb2e3e272bd78e48ab6e0f567d440d3c1e7b4cf241a7aa926b9c12c65d0042ba614f732e5f2547d57a469882de60d68cc310243c93aed6

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
6583df33c56b2c4f5e40df1c0a51f0e5

SHA1
5cd3d59ae96486d354a7d9591997ce21e93ee972

SHA256
acb91c59341b20cc6e2331d4ba412d32e2e0513ce36d474004bc8fdaec26da2a

SHA512
066ab200263511bdd2ee58c1168245cfaa9e85c6cd9c2359f701dbf49c009fd3fdc43c1d3bfa0be446e1bd50ded530010f933d2aec9a1c855720fe10640c4c76

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
e8056dde301189c86754a496f1bc2c0e

SHA1
2ef37a3016989fbf9eee42f34eaaadedc809564b

SHA256
6fa8a160f96c8f5d74ce77d6b93094e3110a40e5c0f700d37f1aa677f0ec491b

SHA512
6e0bbec83a2e82cbc045985bfeeb1cd2a2b8f77e6ad598d2db0cdc6b8b111cd3195b3706197c37a74086b0bc6bf1b97b8a58e17b3af842bf999c53c0313da03b

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
b499e13bff129bf31210b0bb6ca69c7a

SHA1
6b78bcf2867fa886f34996350021d3d8b83e2df3

SHA256
22418a79ef9fd6ef9a2f69be8c920565f247de0c0e24736e59ce0f986f5d5742

SHA512
83f9bd5aacbfece82e7c5fc543c095bc3a1ca375ca69a19b0e43f51ee94d3edd399570b97e1bdecdbac9df8f33514e7f57f2d3dc332d0c6e3655ea9266bf1e9c

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
3b2d06f4c718b88b450ce1ccd437e73f

SHA1
e0b49b16b45bae734cb30316a3237d245f22bdce

SHA256
6a4bf06e7d1c2ec235003c0a21c41fbd4505b0f60b419af144ee6a1c9a9a7610

SHA512
641968623fc81751675ee4ca67dad5964ae77e9d0fbf5f09e82a6dde9a63f88671d7f8637b2d047a4b56402ede648aeafa51420d99056fdaf6f3a566fc5a67bb

Download Submit
C:\Windows\lsass.exe

Filesize
170KB

MD5
927f6917099afdfa894e0b2cef70f1a5

SHA1
6e56f82c4910b1d2ccb59ff52bc69c969b76c075

SHA256
59df7d2be3c2666fae62548d05dbbe208994b4ece60b79993e2544aa5d683288

SHA512
9305bfda3921e32fc04cf61d29281441a778dd5e6cca1f1b6b0c6e74076853a0c0c20eeb31d43591752bb9dabae526f7717d9466fcbc2a9f582b9d8159515140

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
f35065f5ed79a0d6988b4f9b4a359110

SHA1
9cd17538f044b92f777c11f1703935b2a3befca8

SHA256
0ebe242c0a7a1079b74da9f4bb97b43f14598c9e9ae5bf8f1e08a0fd5355dcba

SHA512
de0819aab998100648bb399b8fe16c222c58c586aad48d3871a7282b79208a4c9a7c549d24967180756ada29108506e8622cd89c2a755a2c4ab405f711ec1de9

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
8d205ffd6d88ed41b19caa91a7aa994c

SHA1
5ee0cc6ef7ab500ffb99e42323fe5074b52cce91

SHA256
7500ef088d9a7f141d896bdcc21fc38675dc4763a301d657107ca9622f74ca99

SHA512
8462003ca9aead0737789bdd8a769608e6217e80c82264b439a1d649bc185880220959f9c4b2578cd0467fbca9409bfaeedaf1ab13e70e3a545eb11b239bb68f

Download Submit
memory/1940-63-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1940-317-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-369-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-375-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-381-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-337-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-363-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-113-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-355-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-349-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-343-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-321-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3152-387-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4516-336-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/4516-361-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4516-385-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4516-335-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4516-347-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4516-319-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4516-87-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4516-322-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/4516-373-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4572-78-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4572-318-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4752-344-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4752-290-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4752-356-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4752-350-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4752-338-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4752-329-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4836-292-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4836-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads