57bf98785249fe473e15b2080237a4e34981b407f6a14e7e0caaa7fcb8b4166c

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccfcf87feeddec8308f2a7d21aecc250N.exe
Size

91KB
MD5

ccfcf87feeddec8308f2a7d21aecc250
SHA1

19a6bf3c53c2ec4f0664b2a675313290b2e83f32
SHA256

57bf98785249fe473e15b2080237a4e34981b407f6a14e7e0caaa7fcb8b4166c
SHA512

1ba94e61c665e14c7c923578a8e091af2894d421f1bb571a089386d7f1d637391604e81f4570839a3dcb52509432a05c271b4b20d2035ab8b080fc4df2389f6d
SSDEEP

1536:XJRtlEnBHHIgabuYotV/JbJCX5SBijJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIjvtYxOuYotvYQIE

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	ccfcf87feeddec8308f2a7d21aecc250N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ccfcf87feeddec8308f2a7d21aecc250N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ccfcf87feeddec8308f2a7d21aecc250N.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ccfcf87feeddec8308f2a7d21aecc250N.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2552	xk.exe
2584	IExplorer.exe
2776	WINLOGON.EXE
2884	CSRSS.EXE
1528	SERVICES.EXE
2708	LSASS.EXE
1748	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	ccfcf87feeddec8308f2a7d21aecc250N.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000019261-8.dat	upx
behavioral1/memory/2552-112-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00060000000194ad-111.dat	upx
behavioral1/memory/2552-118-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001957e-115.dat	upx
behavioral1/memory/2584-127-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00050000000195e6-128.dat	upx
behavioral1/memory/2776-139-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2336-142-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2884-148-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001961d-147.dat	upx
behavioral1/files/0x000500000001961f-151.dat	upx
behavioral1/memory/2884-154-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000019621-170.dat	upx
behavioral1/memory/1528-165-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2708-178-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000019622-179.dat	upx
behavioral1/memory/1748-188-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2336-190-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	ccfcf87feeddec8308f2a7d21aecc250N.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	ccfcf87feeddec8308f2a7d21aecc250N.exe
File created	C:\Windows\SysWOW64\shell.exe	ccfcf87feeddec8308f2a7d21aecc250N.exe
File created	C:\Windows\SysWOW64\Mig2.scr	ccfcf87feeddec8308f2a7d21aecc250N.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	ccfcf87feeddec8308f2a7d21aecc250N.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	ccfcf87feeddec8308f2a7d21aecc250N.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	ccfcf87feeddec8308f2a7d21aecc250N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xk.exe	ccfcf87feeddec8308f2a7d21aecc250N.exe
File opened for modification	C:\Windows\xk.exe	ccfcf87feeddec8308f2a7d21aecc250N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	ccfcf87feeddec8308f2a7d21aecc250N.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	ccfcf87feeddec8308f2a7d21aecc250N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2336	ccfcf87feeddec8308f2a7d21aecc250N.exe
2552	xk.exe
2584	IExplorer.exe
2776	WINLOGON.EXE
2884	CSRSS.EXE
1528	SERVICES.EXE
2708	LSASS.EXE
1748	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2552	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	30
PID 2336 wrote to memory of 2552	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	30
PID 2336 wrote to memory of 2552	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	30
PID 2336 wrote to memory of 2552	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	30
PID 2336 wrote to memory of 2584	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	31
PID 2336 wrote to memory of 2584	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	31
PID 2336 wrote to memory of 2584	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	31
PID 2336 wrote to memory of 2584	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	31
PID 2336 wrote to memory of 2776	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	32
PID 2336 wrote to memory of 2776	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	32
PID 2336 wrote to memory of 2776	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	32
PID 2336 wrote to memory of 2776	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	32
PID 2336 wrote to memory of 2884	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	33
PID 2336 wrote to memory of 2884	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	33
PID 2336 wrote to memory of 2884	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	33
PID 2336 wrote to memory of 2884	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	33
PID 2336 wrote to memory of 1528	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	34
PID 2336 wrote to memory of 1528	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	34
PID 2336 wrote to memory of 1528	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	34
PID 2336 wrote to memory of 1528	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	34
PID 2336 wrote to memory of 2708	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	35
PID 2336 wrote to memory of 2708	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	35
PID 2336 wrote to memory of 2708	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	35
PID 2336 wrote to memory of 2708	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	35
PID 2336 wrote to memory of 1748	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	36
PID 2336 wrote to memory of 1748	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	36
PID 2336 wrote to memory of 1748	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	36
PID 2336 wrote to memory of 1748	2336	ccfcf87feeddec8308f2a7d21aecc250N.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	ccfcf87feeddec8308f2a7d21aecc250N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ccfcf87feeddec8308f2a7d21aecc250N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ccfcf87feeddec8308f2a7d21aecc250N.exe

C:\Users\Admin\AppData\Local\Temp\ccfcf87feeddec8308f2a7d21aecc250N.exe
"C:\Users\Admin\AppData\Local\Temp\ccfcf87feeddec8308f2a7d21aecc250N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2336
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2552
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2584
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2776
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2884
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1528
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2708
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
ecde36a9efc49f1dd77fb23167214787

SHA1
885861018efd0276a23db526400058670ec75617

SHA256
28ec1aeb0b81989dba244225057f412dfa8ef0ac733f33359bb8910d8c775a52

SHA512
51558aaf87573e4fc36be1878f3933771c37ac18360316056404c8e053bcbb472c5c8b1a22e39ccdeef1b79a3fa5b3c111a81969893459927169d4d1a11640a6

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
8dc46274130bb1e61e7be5a299ea8b7e

SHA1
7ad008538bbad60078bcde80d83e417bcb5f0f60

SHA256
2ba83b7220569261af7fa693c3fd12ddb8e47b697708e80d5b114ef62a6131ab

SHA512
b8f537fdee522606558bdc162aeeaf4f5de21eaf87dda336dcffc91b76bdd0d73a21d2c15e0fddad2ae5e428d1c6339ecf889e49a4060e16441509b20a0689bb

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
ccfcf87feeddec8308f2a7d21aecc250

SHA1
19a6bf3c53c2ec4f0664b2a675313290b2e83f32

SHA256
57bf98785249fe473e15b2080237a4e34981b407f6a14e7e0caaa7fcb8b4166c

SHA512
1ba94e61c665e14c7c923578a8e091af2894d421f1bb571a089386d7f1d637391604e81f4570839a3dcb52509432a05c271b4b20d2035ab8b080fc4df2389f6d

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
4b258d08101eea5e8f07c8484943127c

SHA1
bee9c2eaf789061a4761d465581220714bb838ba

SHA256
5a0bd7ba236beafc17bb95ce0d361e4190f2f1e67b58beda4b9b3e91bf5574c0

SHA512
957a4e1c6b52eff6d6fbea8717e37a5338867747fa9d6b37922d19f1811d8b37822e503bd0b271d8960faf1a195d7d081a2222c237703b1db4eeaf4b9218b719

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
d82dfdd9742fb39d653ff8b9d3ccfb07

SHA1
c36403a1b4c25d0bb7376496be08dd78cd8180c2

SHA256
1109bccd5b4730ab993f9cbe691bda572b1237607269aff2051dc9537f883e46

SHA512
6606cb406673cf089c57af182251a7746d65aca3a6eb84a025fdbf79ae6068a92a44594e42dae0af97e96e4b74e0ac559010df7278d6918724236371a6c771b2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
982781a43d7f5909efd93ad058a61404

SHA1
1f0be0e59846e83656ca43926f1ff0c7d325012e

SHA256
7070cd6a93944924aabb33bd1cc7f9e29dd58c4dc3bb09d2001f3658a2e685fb

SHA512
57f418942a12b3674781fec4d39ed958fcba7862a42f5a644d446024d2e8cc4c0cda0c2d4475eda3d1d9dc3a8920e88a5841e61a8a0954ce926dbd5b8eff2966

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
ea82fe723da164c268f9094bcbc25db8

SHA1
55ee37b21f335b1a1344b2acf83aaff2212fd473

SHA256
51c964ff3e4cd6ee555b1074e602bdaa1141ae6925dae606c991abb0fb1aa8e8

SHA512
47d4f3bb55d895277af627f3e5e2b2134842c888bab2f9e3f6ade5a2274c5cdfba3336d3ef0328e93890fa899fbf8f8345bb46c628a0ed34fc483a5a08a78a20

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
e0249bc5c66b113085c9762f38371d23

SHA1
106af244a2045839122e7460ff43969b9691e4f9

SHA256
d0d432dde141a6831508e85f7e8e51c3ea25321785427936eca23c50a2787228

SHA512
b8e57a2d606d4083966bf65a9dad70a261b51f6b788ae75d77ec188eeb9e4f9652e54000cbd942578471e016cf16bd59fb7575f4cc81cee8bb5850deb9a530f6

Download Submit
memory/1528-165-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1748-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-134-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/2336-183-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/2336-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-109-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/2336-190-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-110-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/2336-123-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/2336-172-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/2336-171-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/2552-118-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2552-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2584-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2708-178-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2776-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2884-154-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2884-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download