c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ff

Analysis

max time kernel
84s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Size

91KB
MD5

2b237e30ace1840eb0f0cf2151b599a0
SHA1

33dbfda47ed0b1d136f3d288507da6c425e64b11
SHA256

c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ff
SHA512

3b93adbbec97e0869d8aedbeab70dd6b47723423ee2da745a88c0d4348398137a8353adb7efde73cfcf00937cde4c75db52c877ffe1393e05f38ac989eba0113
SSDEEP

1536:XRsjdLaslqdBXvTUL0Hnouy8VjgRsjdLaslqdBXvTUL0Hnouy8VjK:XOJKqsout9gOJKqsout9K

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2096	xk.exe
2400	IExplorer.exe
2416	WINLOGON.EXE
2008	CSRSS.EXE
2772	SERVICES.EXE
1652	LSASS.EXE
2936	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0007000000015d48-8.dat	upx
behavioral1/files/0x0008000000015da1-111.dat	upx
behavioral1/files/0x000500000001867d-114.dat	upx
behavioral1/memory/2096-117-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2400-126-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001878d-127.dat	upx
behavioral1/memory/2416-138-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00060000000190c6-139.dat	upx
behavioral1/memory/2112-141-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2008-149-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00060000000190c9-150.dat	upx
behavioral1/memory/2772-159-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00050000000191f3-166.dat	upx
behavioral1/memory/1652-170-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00050000000191fd-171.dat	upx
behavioral1/memory/2936-179-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2936-182-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2112-184-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mig2.scr	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
File created	C:\Windows\SysWOW64\shell.exe	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
File created	C:\Windows\xk.exe	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
2096	xk.exe
2400	IExplorer.exe
2416	WINLOGON.EXE
2008	CSRSS.EXE
2772	SERVICES.EXE
1652	LSASS.EXE
2936	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2096	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	31
PID 2112 wrote to memory of 2096	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	31
PID 2112 wrote to memory of 2096	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	31
PID 2112 wrote to memory of 2096	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	31
PID 2112 wrote to memory of 2400	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	32
PID 2112 wrote to memory of 2400	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	32
PID 2112 wrote to memory of 2400	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	32
PID 2112 wrote to memory of 2400	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	32
PID 2112 wrote to memory of 2416	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	33
PID 2112 wrote to memory of 2416	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	33
PID 2112 wrote to memory of 2416	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	33
PID 2112 wrote to memory of 2416	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	33
PID 2112 wrote to memory of 2008	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	34
PID 2112 wrote to memory of 2008	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	34
PID 2112 wrote to memory of 2008	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	34
PID 2112 wrote to memory of 2008	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	34
PID 2112 wrote to memory of 2772	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	35
PID 2112 wrote to memory of 2772	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	35
PID 2112 wrote to memory of 2772	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	35
PID 2112 wrote to memory of 2772	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	35
PID 2112 wrote to memory of 1652	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	36
PID 2112 wrote to memory of 1652	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	36
PID 2112 wrote to memory of 1652	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	36
PID 2112 wrote to memory of 1652	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	36
PID 2112 wrote to memory of 2936	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	37
PID 2112 wrote to memory of 2936	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	37
PID 2112 wrote to memory of 2936	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	37
PID 2112 wrote to memory of 2936	2112	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe	37

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe

C:\Users\Admin\AppData\Local\Temp\c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe
"C:\Users\Admin\AppData\Local\Temp\c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ffN.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2112
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2096
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2400
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2416
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2008
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2772
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1652
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
f909a976c2589b8d6aa73ca8116c09c3

SHA1
e2e4b5a2b8e47de96413a4e593d8be2422672497

SHA256
b43435b24fdb37b72ac624349a858c862637c79bc91f6e7c8062b3ba5575e9d4

SHA512
50a50dda44a926d16b04fa1c3dfaf887b21ef2e1d82f26c89bfa88da5150497ae5c4e598186619acde734b79a4dc51fc1ce8d32788d77a9e62d74a2750381d4f

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
2b237e30ace1840eb0f0cf2151b599a0

SHA1
33dbfda47ed0b1d136f3d288507da6c425e64b11

SHA256
c09cc3f87ca2a3f8f95221963d4283202c502453c3c36a5fb6162c0f226040ff

SHA512
3b93adbbec97e0869d8aedbeab70dd6b47723423ee2da745a88c0d4348398137a8353adb7efde73cfcf00937cde4c75db52c877ffe1393e05f38ac989eba0113

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
a8ba099b5d2a43497ac818c66ada475f

SHA1
4ef4b370eaa8dcc0d2547c55be96feaadba5a389

SHA256
f391328fc463634d179b6f3e5ab92e09f90ca59f3bd54da3d51c7fd47ef084e9

SHA512
c4b03491deea93f914228260d890021284df7847a215f1bd909d7d40d5da48554314a83c886b6acb1031cac2f10859dd080d2f4e080aeff644b6636c265ed841

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
76e580493d74a7ec7338987ea12bedfe

SHA1
5af6623d20eadc8153e047570e6b22fc4d936401

SHA256
ba849330430f2746f1a8d4b3d29021d4d4edda854b1f00a1bf6ff1f2720f9a45

SHA512
a98ce912ec46a9677a1e37ce516644276b7d344a13dd120f58b75ba87070670e8e656d953bd65569478f839b53f2d96085aaba3a57c486a53ef0d579be57ff0f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
2ad3c2282b87dc9157ae68fc13e117c3

SHA1
77f1bf2f16ecd5cd3f925093d6bf748d2727dc1c

SHA256
db885cf6acc6d178a338946bb4db8c32f293df6fa6ec2c2bbf6c531d91e49a48

SHA512
b338389fdb5b675e17e6fa898ebe95be8ad378fb78541d94202e61095f2ec450004312397adc8e247c1c543a3ad04fd67e3edf9e441fc66b77b28687e442f4e1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
3d4270d259dad8faf2c98311d014cad3

SHA1
8acbfc6a95e4e65c7f9318eae4a6b86b8966f271

SHA256
c07d069ebf5764323cf7f951b3cd57043a0d087ccb575b28ae7f238f1b38448a

SHA512
75cf2e114fb11b8f5032e589e2b83a1998b71252f97fd31ca2723aa546b7dac474abc6e47176e270c57f4138bed7aa685105bf89b6448bf5a2c5a5817ea50a30

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
a143be432204e13393d9bbf31b84833d

SHA1
dbfb2179b5143a15e571782f240af7d9bf2fd21c

SHA256
e21d1879950900eef720d17cdb7f375762e3bd56b9b564ed3d5386918f39fa29

SHA512
f3ccde229e68023007a29e3ff26040d75563ae3750468755653c15d4968a085f9e575d98061b99e56ddc527ff04e87533347a939179530246e2588d4c6c811a2

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
2adf2629f59151adf922fe4dde24c1b3

SHA1
00f6ceadb0c160208ef1c8ba82635654a3bec72f

SHA256
fcc87c6703a576d58d928be60977850a87e0938808f9f697d6c1c766ca6baf68

SHA512
459916624ae7ec55d5523465d00bd45b96fe0d9890d7587786ad172171fbdcf37d4915456ba64b7b83b90f996120a16061993244cb7095d9a5dbb0a1ceb34249

Download Submit
memory/1652-170-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2008-149-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2096-117-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2112-123-0x0000000002660000-0x000000000268F000-memory.dmp

Filesize
188KB

Download
memory/2112-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2112-133-0x0000000002660000-0x000000000268F000-memory.dmp

Filesize
188KB

Download
memory/2112-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2112-134-0x0000000002660000-0x000000000268F000-memory.dmp

Filesize
188KB

Download
memory/2112-184-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2112-178-0x0000000002660000-0x000000000268F000-memory.dmp

Filesize
188KB

Download
memory/2112-110-0x0000000002660000-0x000000000268F000-memory.dmp

Filesize
188KB

Download
memory/2112-109-0x0000000002660000-0x000000000268F000-memory.dmp

Filesize
188KB

Download
memory/2400-126-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2772-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2936-179-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2936-182-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download