53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcd

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Size

91KB
MD5

2bde5b0f373cd81f12f024a946ae3900
SHA1

de17b8c314c99eddbc2e6755f6db8e1a5a9a7ed0
SHA256

53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcd
SHA512

4b69c30e80a1b6dddb2d4ef032dcc051b6785d9eb26260d4396bf1d7d12fe9afcabaf5a362288a13ae08f3af4c930de5193f2e3907320ba43c98227568695be3
SSDEEP

1536:1AwEmBT4JzRJwEeUW7f12xULgJzjAwEmBT4JzRJwEeUW7f12xULgJzV:1Gml41LBu7f1WNjGml41LBu7f1WNV

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
276	xk.exe
336	IExplorer.exe
1652	WINLOGON.EXE
2504	CSRSS.EXE
1028	SERVICES.EXE
2360	LSASS.EXE
540	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
File created	C:\Windows\SysWOW64\shell.exe	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
File created	C:\Windows\SysWOW64\Mig2.scr	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
File created	C:\Windows\xk.exe	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
276	xk.exe
336	IExplorer.exe
1652	WINLOGON.EXE
2504	CSRSS.EXE
1028	SERVICES.EXE
2360	LSASS.EXE
540	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 276	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	30
PID 2652 wrote to memory of 276	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	30
PID 2652 wrote to memory of 276	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	30
PID 2652 wrote to memory of 276	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	30
PID 2652 wrote to memory of 336	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	31
PID 2652 wrote to memory of 336	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	31
PID 2652 wrote to memory of 336	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	31
PID 2652 wrote to memory of 336	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	31
PID 2652 wrote to memory of 1652	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	32
PID 2652 wrote to memory of 1652	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	32
PID 2652 wrote to memory of 1652	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	32
PID 2652 wrote to memory of 1652	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	32
PID 2652 wrote to memory of 2504	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	33
PID 2652 wrote to memory of 2504	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	33
PID 2652 wrote to memory of 2504	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	33
PID 2652 wrote to memory of 2504	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	33
PID 2652 wrote to memory of 1028	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	34
PID 2652 wrote to memory of 1028	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	34
PID 2652 wrote to memory of 1028	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	34
PID 2652 wrote to memory of 1028	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	34
PID 2652 wrote to memory of 2360	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	35
PID 2652 wrote to memory of 2360	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	35
PID 2652 wrote to memory of 2360	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	35
PID 2652 wrote to memory of 2360	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	35
PID 2652 wrote to memory of 540	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	36
PID 2652 wrote to memory of 540	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	36
PID 2652 wrote to memory of 540	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	36
PID 2652 wrote to memory of 540	2652	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe

C:\Users\Admin\AppData\Local\Temp\53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe
"C:\Users\Admin\AppData\Local\Temp\53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcdN.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2652
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:276
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:336
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1652
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2504
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1028
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2360
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
2bde5b0f373cd81f12f024a946ae3900

SHA1
de17b8c314c99eddbc2e6755f6db8e1a5a9a7ed0

SHA256
53713370c4f9fb2d9280195fb93ca7764f31f4731043d7dbce6e232e8cf8edcd

SHA512
4b69c30e80a1b6dddb2d4ef032dcc051b6785d9eb26260d4396bf1d7d12fe9afcabaf5a362288a13ae08f3af4c930de5193f2e3907320ba43c98227568695be3

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
7b416183962b4dcd2a26c9e71801ade8

SHA1
1cbf1b6663357270238e3445bbbcde56f1c1489a

SHA256
45824fe5c0851cc3770ce9478a7ec12106f827cb396473a1f6261bb71aba038d

SHA512
0d254b08dee8e7f103d1acc7be2c5c0b2268044b86749196e24313404fefb0577cc8ed73b78807a551345bdc1552550013b16029d9f305cbf663bb908f21fe6f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
93fa9b63aba6d6a14db4d124cae71b42

SHA1
10b11767f40808d51c48b4a42760550cbcfb4500

SHA256
42a30cacd78cc08f58482d9eab7dd2eeaad82e0b1e587eab907835d3cb3f46a3

SHA512
008d124ae67024d5acfb03a5661672c201176d095c7ac2df9651abd632e3059f9a6d43becec0157389c38f2e37b4ae7ee065c07b74a95d053871a521a0a955e1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
56803561c1a3532f6c95a7e5d9bb904b

SHA1
4de6d7d86237678556a1f038e4acae5db24360a5

SHA256
9a236dba94253110507425f60fbecf32c5e7be63af3160fde70096792f9aec8d

SHA512
5e119fd27312334d773b046685de5d757040018a27e599a4bb085b65803c0927a3f726f0a7ceaa75200e2eda273f7f13008a05483159a162441b9b97e6ec838e

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
8acfe22dc47b873444b6294adffd2db8

SHA1
6768db11312fb2487d16e224e4602e4734ca4cb5

SHA256
6fd85aa114386f1b4732c97700090482634a3e0956af17157fa39f2d4f6d306c

SHA512
b674a96ec247a93c922d32782bd8dc7b1bd24c503d787d3e3d141ec1f0691f67469c7691d97af756a9b5b79b1a70af2c5127a1edbfb4614d9ddb90f8e3d8e7c8

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
0dca8d3a78fa7fdfb40a31b7b7c640f4

SHA1
761eea5f9f423a7788fa369ce6df8adec9ed9188

SHA256
372dc7066da5109e7ebd6a326a7d839ed6571d0f79b90e251bbffdcdb4ca50b8

SHA512
1c6b8d2b11a81e787f708c4c86512aeaab344c2602e445752d47c04cb3d345cf09cca2d96d86ff27cc28df9f0e01a4291400be4c8651ebb443dc9bb115f133f0

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
c34aecc19c22c16c1f2da7cedb02ad39

SHA1
97e876ef2a09a9f26eddbc4b24116afd506abd58

SHA256
c389766e33cf692ca3ac9cf09e8c49a4c6f1176d1e2c10f2dec059dea9825cae

SHA512
e9c0e916bc6749adba205d6656f61a13d5a91c35e91cbdebbc2a76784c1b5c503ffb076086498b1f80030662c9964166dc9c4e3870d8434139e7e9c3c26a07de

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
7eeaff7ea31362b3a8832b688a4ac797

SHA1
7fe7f8c900dfa0ccd5d5703a743e6c548abcd569

SHA256
2d1ae462521d995cb003137d518dc396288f849198cace26e390b5bc68f47cba

SHA512
48c24063b27cb2d9381b8d179998bed7d62270a08f746fe919778c499da51fb2bec0a863ec1de6967be31785a7f5ee46790fbcf954ec62510f97a3603cdb021a

Download Submit
memory/276-113-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/336-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/540-182-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1028-162-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1652-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2360-170-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2504-150-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2652-143-0x00000000025D0000-0x00000000025FE000-memory.dmp

Filesize
184KB

Download
memory/2652-155-0x00000000025D0000-0x00000000025FE000-memory.dmp

Filesize
184KB

Download
memory/2652-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2652-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2652-121-0x00000000025D0000-0x00000000025FE000-memory.dmp

Filesize
184KB

Download
memory/2652-183-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2652-109-0x00000000025D0000-0x00000000025FE000-memory.dmp

Filesize
184KB

Download