33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994

Analysis

max time kernel
20s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Size

91KB
MD5

c133595b77881491e17c14fc84e3e9d0
SHA1

0cdeb6d46354527e71287b09d93adc75c7117896
SHA256

33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994
SHA512

54b39c02759ee7ec0a95b4005dbe9e52d01f662dc0809fb72668021ceb86b6ca2063403c69ce8f9ce2f5197b4e20bfd83c5765aad17079f7f03cdc0700b7f8c1
SSDEEP

1536:1AwEmBT4JzRJwEeUW7f12xULgJzUAwEmBT4JzRJwEeUW7f12xULgJzY:1Gml41LBu7f1WNUGml41LBu7f1WNY

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2468	xk.exe
2932	IExplorer.exe
1492	WINLOGON.EXE
1908	CSRSS.EXE
2672	SERVICES.EXE
2920	LSASS.EXE
1152	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
File created	C:\Windows\SysWOW64\shell.exe	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
File created	C:\Windows\SysWOW64\Mig2.scr	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
File created	C:\Windows\xk.exe	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
2468	xk.exe
2932	IExplorer.exe
1492	WINLOGON.EXE
1908	CSRSS.EXE
2672	SERVICES.EXE
2920	LSASS.EXE
1152	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2468	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	30
PID 2788 wrote to memory of 2468	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	30
PID 2788 wrote to memory of 2468	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	30
PID 2788 wrote to memory of 2468	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	30
PID 2788 wrote to memory of 2932	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	31
PID 2788 wrote to memory of 2932	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	31
PID 2788 wrote to memory of 2932	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	31
PID 2788 wrote to memory of 2932	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	31
PID 2788 wrote to memory of 1492	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	32
PID 2788 wrote to memory of 1492	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	32
PID 2788 wrote to memory of 1492	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	32
PID 2788 wrote to memory of 1492	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	32
PID 2788 wrote to memory of 1908	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	33
PID 2788 wrote to memory of 1908	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	33
PID 2788 wrote to memory of 1908	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	33
PID 2788 wrote to memory of 1908	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	33
PID 2788 wrote to memory of 2672	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	34
PID 2788 wrote to memory of 2672	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	34
PID 2788 wrote to memory of 2672	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	34
PID 2788 wrote to memory of 2672	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	34
PID 2788 wrote to memory of 2920	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	35
PID 2788 wrote to memory of 2920	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	35
PID 2788 wrote to memory of 2920	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	35
PID 2788 wrote to memory of 2920	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	35
PID 2788 wrote to memory of 1152	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	36
PID 2788 wrote to memory of 1152	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	36
PID 2788 wrote to memory of 1152	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	36
PID 2788 wrote to memory of 1152	2788	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe

C:\Users\Admin\AppData\Local\Temp\33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe
"C:\Users\Admin\AppData\Local\Temp\33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2788
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2468
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2932
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1492
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1908
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2672
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2920
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\services.exe

Filesize
91KB

MD5
c133595b77881491e17c14fc84e3e9d0

SHA1
0cdeb6d46354527e71287b09d93adc75c7117896

SHA256
33c5a2ff947db985a3608085144c10b60ef494d7e7a4c45b68570d4a4081d994

SHA512
54b39c02759ee7ec0a95b4005dbe9e52d01f662dc0809fb72668021ceb86b6ca2063403c69ce8f9ce2f5197b4e20bfd83c5765aad17079f7f03cdc0700b7f8c1

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
2d4f9fef3c7ef0f413fa000d3b982654

SHA1
4ebbf2dea5e0635f7d679310777c5bc53515ebdc

SHA256
ae8d3a545640a1abdbe7ee39d6c1dbf35423a8294e62aa22f7f76e11caa6202e

SHA512
3697072b64d48f8d67c23d24442ef910a0228105c85778fbc61ac6f5630b11fa1dd9260f8f187e5687ac86ae2f82a01dafbe265277aaaec7e212f535ec00af20

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
888da41711dd8887e53d4825a01e43ae

SHA1
95c73d40e708cfaed041bc5fd25d82e8a4705cb1

SHA256
ea1b125507b835bcab64569304e65df5dcbb0a99db2fb31353e3d879e292733e

SHA512
e9e56b410627f65531c87d01389bfcb3ccac7e074145edae21373475e3ec97b03cf898914fc2d217c4cf3ec73c6ffd35f042aaf62e36c9c64222ec7cd8913fda

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
f53cb4a18b6430b0d0849fcbbf082cb8

SHA1
d7708a97e9b5f256489c68408e35d8a43114f6f0

SHA256
56b379b2642725436fce4e241b80df211f31658c7a49d5861ef084dad1f88dac

SHA512
182318be213c6f0f11a01004c9f8913827408b801cf17f0b2167cdc56a943aecf349f2e26e3be9675a2a484413e225f01eb78705c8742b0155d0a58907d741b9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
9ad3cf8cb12e8eda4973483bab737b86

SHA1
e3370991cd33189ef0a963a094d3c2a48e975b81

SHA256
18ac60dc5fccf279ae1ea47c6e238bc9ba7acc4826734de9f1e841a758cf9351

SHA512
a2084d51b246720530e631974257d7716dc233beafa92cd5fee1db0aa55e0c27f4bb7edbb4b7662fa7627bac5c8fce98cace28a7efe68b262372287e67173faf

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
8ca332ab34d93437a377e7864d16589e

SHA1
5330c7d948b8e73fc3122dfcbc92667e3d57e3ba

SHA256
b432c421e3e825bca6bc65230123396633fdb347a1304679dadc7fefa124a886

SHA512
74c78601286bf06bf9fc4358430dde6248a61f07a2063b29d6e39b5f51001607baf797afd9a376e920e863fd9827127b0103fdfcd66e4817744246534f16dad6

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
6405d0a08598a3ca55b85ead7162bb06

SHA1
5f4a44940d748a3c49653782542bc36375df603b

SHA256
e3efa25f131c85383cc09e6b2b78619c494722df04bfdf0c30ad213a6ffcc43c

SHA512
d03c8a3f6dfa3ff116840f51c405f3f4a9ab73f5d0b5d88254b8cb776f461ffeaf761cc4a424fea7cfa6a2809f53739f0e4365c709bb33ff767a2c08e0f4db96

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
dc1811adf41aa7407276e140d3e77f36

SHA1
b31ac0fd51d7bced140d7e2e1362d39f347246d1

SHA256
387366f93a87517314b531f34303ac74efd56ee208491138a31320e64a939bec

SHA512
880519036c494c1bd482820b317f67502a8fa5de74bea235dca7f2f42eb2f0c9aefbe03a6d0e76decc14fa120872f84d4f09b809f45c1deb790d136b481bf060

Download Submit
memory/1152-181-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1492-135-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1908-144-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1908-147-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2468-113-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2468-109-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2672-158-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2788-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2788-155-0x0000000000540000-0x000000000056E000-memory.dmp

Filesize
184KB

Download
memory/2788-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2788-130-0x0000000000540000-0x000000000056E000-memory.dmp

Filesize
184KB

Download
memory/2788-131-0x0000000000540000-0x000000000056E000-memory.dmp

Filesize
184KB

Download
memory/2788-173-0x0000000000540000-0x000000000056E000-memory.dmp

Filesize
184KB

Download
memory/2788-182-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2920-169-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2932-123-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download