Analysis
-
max time kernel
34s -
max time network
38s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 21:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe
Resource
win7-20240903-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
22 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe
-
Size
2.7MB
-
MD5
b40871d23e2fa2f277540c332a4440be
-
SHA1
d2f941a9bc8af6d622cb4ff333724dc381c9b736
-
SHA256
f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887
-
SHA512
d3e00138c209436d47409da3af259de5c15205ccb28f32f4bb825544fced6814d368042b8986c927ed61fa1de8336f3b20be6efa898b8e0d83f189629b56f5d7
-
SSDEEP
49152:/IDwxS03F7//+M+cXyxkKYDuayq2G1JdWcl/dXUONFjUE08B+UUPU8:Ayl3F7//+MfKYDuC2yPkO0GBOL
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\\\www.ini" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2764 attrib.exe 2940 attrib.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000d000000015ceb-1.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
resource yara_rule behavioral1/files/0x000d000000015ceb-1.dat upx behavioral1/memory/2308-4-0x0000000074720000-0x000000007475C000-memory.dmp upx behavioral1/memory/2308-9-0x0000000074720000-0x000000007475C000-memory.dmp upx behavioral1/memory/2308-10-0x0000000074720000-0x000000007475C000-memory.dmp upx behavioral1/memory/2308-28-0x0000000074720000-0x000000007475C000-memory.dmp upx behavioral1/memory/2308-29-0x0000000074720000-0x000000007475C000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "c:\\1.jpg" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\WallpaperStyle = "2" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\TileWallpaper = "2" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmdt\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QQ.exe f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.e f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ec\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmdt f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QQ.exe\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.miu\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.e\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.inf\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.miu f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ec f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "²¡¶¾" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe Token: SeShutdownPrivilege 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2764 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 31 PID 2308 wrote to memory of 2764 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 31 PID 2308 wrote to memory of 2764 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 31 PID 2308 wrote to memory of 2764 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 31 PID 2308 wrote to memory of 2112 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 33 PID 2308 wrote to memory of 2112 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 33 PID 2308 wrote to memory of 2112 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 33 PID 2308 wrote to memory of 2112 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 33 PID 2308 wrote to memory of 2904 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 34 PID 2308 wrote to memory of 2904 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 34 PID 2308 wrote to memory of 2904 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 34 PID 2308 wrote to memory of 2904 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 34 PID 2308 wrote to memory of 2756 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 37 PID 2308 wrote to memory of 2756 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 37 PID 2308 wrote to memory of 2756 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 37 PID 2308 wrote to memory of 2756 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 37 PID 2308 wrote to memory of 3040 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 40 PID 2308 wrote to memory of 3040 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 40 PID 2308 wrote to memory of 3040 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 40 PID 2308 wrote to memory of 3040 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 40 PID 3040 wrote to memory of 3068 3040 net.exe 43 PID 3040 wrote to memory of 3068 3040 net.exe 43 PID 3040 wrote to memory of 3068 3040 net.exe 43 PID 3040 wrote to memory of 3068 3040 net.exe 43 PID 2308 wrote to memory of 2940 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 44 PID 2308 wrote to memory of 2940 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 44 PID 2308 wrote to memory of 2940 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 44 PID 2308 wrote to memory of 2940 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 44 PID 2308 wrote to memory of 2608 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 46 PID 2308 wrote to memory of 2608 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 46 PID 2308 wrote to memory of 2608 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 46 PID 2308 wrote to memory of 2608 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 46 PID 2308 wrote to memory of 2824 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 47 PID 2308 wrote to memory of 2824 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 47 PID 2308 wrote to memory of 2824 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 47 PID 2308 wrote to memory of 2824 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 47 PID 2308 wrote to memory of 2016 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 50 PID 2308 wrote to memory of 2016 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 50 PID 2308 wrote to memory of 2016 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 50 PID 2308 wrote to memory of 2016 2308 f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe 50 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2764 attrib.exe 2940 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe"C:\Users\Admin\AppData\Local\Temp\f6d2a096d2f84946c85ceba852d97989da318ad6bf12fb439d8db07018859887.exe"1⤵
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2308 -
C:\Windows\SysWOW64\attrib.exeattrib +s +a +h +r ¾¯¸æ.exe2⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2764
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵
- Disables RegEdit via registry modification
- System Location Discovery: System Language Discovery
PID:2112
-
-
C:\Windows\SysWOW64\regini.exeregini www.ini2⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2904
-
-
C:\Windows\SysWOW64\regini.exeregini www.ini2⤵PID:2756
-
-
C:\Windows\SysWOW64\net.exenet user Admin 123456789876544567898765456789yfghjhbvbnmnbv2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user Admin 123456789876544567898765456789yfghjhbvbnmnbv3⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +a +h +r ¾¯¸æ.exe2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2940
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵PID:2608
-
-
C:\Windows\SysWOW64\regini.exeregini www.ini2⤵PID:2824
-
-
C:\Windows\SysWOW64\regini.exeregini www.ini2⤵PID:2016
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2948
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1428
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
3Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD551e9c408acf648c40340cdaf57e7b031
SHA1ae6afe04a08cf9a918f954ebc634028fbf26d977
SHA25639c0572849bdc5ede4fd7894c704d5710e421b56582ff439206790ce05b84368
SHA512e1508f8241c9a53981b441e6eef22dc4a98ab2d083ac471f976d18b5d0a2e3029f8705461a0ea80a8435e59f363d53994a621059ba0f2db4f4118c7db6a2d70e
-
Filesize
101B
MD5df98f458d660ecdf388d0d7098b92879
SHA14bf6e30eb206475678d13860b72fd89792e177cd
SHA256ce80722c95f952938a53b800a0633bf85625c06ad7d6cc9c9c3a8d5ee1f4d979
SHA5120ce2c057b5ae123d8d98f6032b80ea273573223976a60fb86a29ffeff4234598d828da6d28476f12e9938887d2c11fbb1fd3b18290efdc102b210c9146803778
-
Filesize
97KB
MD5c35425ad1f0c32225d307310deccc335
SHA1b2e347b244e40ffa113dffaffd1895777e3ac30a
SHA25648773d597155dc39dd172c26867972da89dd61fcee0d138433eda26a2d8633b7
SHA51247b6a7447fcc4f9f21018f608fcbdb5650f16cbd869cae5d4ed5d9b88ca1e944de1cac10e9a252aa7b210f1a31456c0ed91728b8a7e24def99d7e3f9683e2bae
