b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Size

88KB
MD5

a365fc317e0f541ed1d72463a19e99af
SHA1

47c9b8ed077ac9ceea07df5c832e5fd8002fcb9d
SHA256

b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6
SHA512

0f3e483e11f919ac7b04653701bfab4bc074f769818053018061ec6edd64fe4e72de597b25d1f52107215cb8b6f2bbff9ec32a37fcb13a2ae36e983c83071bf3
SSDEEP

1536:ERsjdf1aM67v32Z9x5nouy8VTWRsjdf1aM67v32Z9x5nouy8VT:EOaHv3YpoutNWOaHv3YpoutN

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2656	xk.exe
2436	IExplorer.exe
1716	WINLOGON.EXE
2892	CSRSS.EXE
984	SERVICES.EXE
2700	LSASS.EXE
1432	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2540-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0007000000019273-8.dat	upx
behavioral1/memory/2656-111-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000019384-110.dat	upx
behavioral1/files/0x000500000001a41d-115.dat	upx
behavioral1/memory/2656-116-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001a455-128.dat	upx
behavioral1/memory/2436-132-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001a477-142.dat	upx
behavioral1/memory/2540-146-0x00000000026F0000-0x000000000271F000-memory.dmp	upx
behavioral1/memory/2540-141-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1716-140-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2892-150-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001a478-151.dat	upx
behavioral1/memory/984-161-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001a486-162.dat	upx
behavioral1/memory/2700-174-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001a48a-172.dat	upx
behavioral1/memory/1432-184-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2540-185-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
File created	C:\Windows\SysWOW64\shell.exe	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
File created	C:\Windows\SysWOW64\Mig2.scr	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
File created	C:\Windows\xk.exe	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
2656	xk.exe
2436	IExplorer.exe
1716	WINLOGON.EXE
2892	CSRSS.EXE
984	SERVICES.EXE
2700	LSASS.EXE
1432	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2656	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	30
PID 2540 wrote to memory of 2656	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	30
PID 2540 wrote to memory of 2656	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	30
PID 2540 wrote to memory of 2656	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	30
PID 2540 wrote to memory of 2436	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	31
PID 2540 wrote to memory of 2436	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	31
PID 2540 wrote to memory of 2436	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	31
PID 2540 wrote to memory of 2436	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	31
PID 2540 wrote to memory of 1716	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	32
PID 2540 wrote to memory of 1716	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	32
PID 2540 wrote to memory of 1716	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	32
PID 2540 wrote to memory of 1716	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	32
PID 2540 wrote to memory of 2892	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	33
PID 2540 wrote to memory of 2892	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	33
PID 2540 wrote to memory of 2892	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	33
PID 2540 wrote to memory of 2892	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	33
PID 2540 wrote to memory of 984	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	34
PID 2540 wrote to memory of 984	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	34
PID 2540 wrote to memory of 984	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	34
PID 2540 wrote to memory of 984	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	34
PID 2540 wrote to memory of 2700	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	35
PID 2540 wrote to memory of 2700	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	35
PID 2540 wrote to memory of 2700	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	35
PID 2540 wrote to memory of 2700	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	35
PID 2540 wrote to memory of 1432	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	36
PID 2540 wrote to memory of 1432	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	36
PID 2540 wrote to memory of 1432	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	36
PID 2540 wrote to memory of 1432	2540	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe

C:\Users\Admin\AppData\Local\Temp\b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe
"C:\Users\Admin\AppData\Local\Temp\b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2540
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2656
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2436
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1716
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2892
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:984
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2700
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
88KB

MD5
a365fc317e0f541ed1d72463a19e99af

SHA1
47c9b8ed077ac9ceea07df5c832e5fd8002fcb9d

SHA256
b8f6dca11ee276a67d3a209a37eae287bb3ad72eb1f8b728d5ca2fe204dd42a6

SHA512
0f3e483e11f919ac7b04653701bfab4bc074f769818053018061ec6edd64fe4e72de597b25d1f52107215cb8b6f2bbff9ec32a37fcb13a2ae36e983c83071bf3

Download Submit
C:\Windows\xk.exe

Filesize
88KB

MD5
30a192e66cbd547924305b5a46cc8ac6

SHA1
f97a383e6847a204ef6aaa31d30020aecad3bb19

SHA256
046531c6b333418dbeb79851fdacad1f9d71fa22b131e24f07603167e4ed90ee

SHA512
adfafa3da8aa268fa0afaabc2d5de3b0896d476b749304a47d0cff15aa4dbecfa7eb0998ce437c57df5c23a9406c76df052910a6574a3d68f3051658c73db414

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
88KB

MD5
dc5bfcaf77f419adec5170c97e3463fb

SHA1
5548b4e49b9d0ca908a99a8581ed752e760ae208

SHA256
60d7b6a35d34758410af8273a39d76d52aa2a0fe0b759a12d3d8ec8a1ce04d3e

SHA512
14490c3f1674937d4abf993020b40a64b323d03e6a123b13dda4128844945452071eda51fef451d71a3ca1561eb4a6615026a2631f3524365a71ef1231c4c3a9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
88KB

MD5
4f5a6b26c79695a4759c3b9f1dc498d4

SHA1
2f474d13124e68b85039b01ad416e830ce87ff0f

SHA256
821ba8af1e906bf7681a5e64f66acbb974af2ab682010c3a31846c5402d790f0

SHA512
b62a68f2d67c1335f49ade56eac92ae9ca0b7d115c669904b9bedcdde228294ee43dce12185047fc5fa2aa26d597735d43d9c087a7261f4b02b124a4093675f3

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
88KB

MD5
a6c21a4749650a8ebf7413cc20ebd563

SHA1
d1761dad0e690ca5416366d8e624c325fb663984

SHA256
5bea5d6758ad104a46dbdebc04d89ceed8173b6721c32b0fb3ad619323621916

SHA512
4695848645c388a60f7875bf66cb24df4847e6311451a3e210cf178cfe72b8be2535cbcd045b01f212a3b12309ca9b6f3cd970aedbf1f9d160ae5d1e89de3ec8

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
88KB

MD5
205aadbf4e55210770fc023aed813e5f

SHA1
8b966ed25dbbaca3d1b0190ad61e9ead56a4b2c7

SHA256
8984530e1aaf3b70454abdbe58a648f27a9b0e652f68de6e64af4453f2064ae0

SHA512
f019564d5a260e13c4313c198c5018c121d00eedabb46f00ec80a9d03fd31a436267feca851ca61ce6ea1ca16b1b8452918358b7141cd1878ed4cc824131f166

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
88KB

MD5
631f2a8bbb4b0aa28cf143244e47c345

SHA1
9a99fc49ba02176d92d1f18738a2028b33a23851

SHA256
678af47fd9c82ffd1e4b7fc0d74755268cc19698717c3135ff2f5acc749e6f00

SHA512
f22012b4b2f15af755820bdd3ecab6f499eda7e94e67e719fc4e673f6d0ec1495908d8687355ed34c592b5890b2b7bd596742b373e09c6971310f0bcd3c2f2b7

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
88KB

MD5
78bd1e245ca0aef873292860f4d7f0f1

SHA1
85ccf7f0f0952e9c027b88e983b51a5d94976dab

SHA256
9a13058ce7cac188ee945c2ff8e9ff935bb24adfb08bf111e28de57b4b39f206

SHA512
a271e2653caf8b768b393036f6d248727ff08328785a8efe5168936958ad521df6d5b152079e305281444af8f6c8eebf97823d8f2953de364adc2c836e14f7b8

Download Submit
memory/984-161-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1432-184-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1716-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2436-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2540-146-0x00000000026F0000-0x000000000271F000-memory.dmp

Filesize
188KB

Download
memory/2540-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2540-109-0x00000000026F0000-0x000000000271F000-memory.dmp

Filesize
188KB

Download
memory/2540-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2540-157-0x00000000026F0000-0x000000000271F000-memory.dmp

Filesize
188KB

Download
memory/2540-133-0x00000000026F0000-0x000000000271F000-memory.dmp

Filesize
188KB

Download
memory/2540-185-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2656-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2656-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-174-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2892-150-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download