1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0db

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Size

45KB
MD5

fc04ee8fd24f7b363731651f601b4cf0
SHA1

54b37e1124d1a95b3786fb63acbee106b210d3ad
SHA256

1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0db
SHA512

93a38c2b3b5e8fc23cc4d77131da7ee06d6d1ea4eefb5c07cf9604d71a16044a1f3e4fc1b702c9cdbd91d92be57baa6d08ab1d6da42f885649e62eafe654e26f
SSDEEP

768:xmFQj8rM9whcqet8Wfxd9Mmnfa+TAOBJgZiPGyilSniJO14ktp7DFK+5nE/:zAwEmBZ04faWmtN4nic+6G/

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2604	xk.exe
2580	IExplorer.exe
3016	WINLOGON.EXE
1608	CSRSS.EXE
1984	SERVICES.EXE
1696	LSASS.EXE
904	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
File created	C:\Windows\SysWOW64\shell.exe	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
File created	C:\Windows\SysWOW64\Mig2.scr	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xk.exe	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
File opened for modification	C:\Windows\xk.exe	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
2604	xk.exe
2580	IExplorer.exe
3016	WINLOGON.EXE
1608	CSRSS.EXE
1984	SERVICES.EXE
1696	LSASS.EXE
904	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2604	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	30
PID 2292 wrote to memory of 2604	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	30
PID 2292 wrote to memory of 2604	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	30
PID 2292 wrote to memory of 2604	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	30
PID 2292 wrote to memory of 2580	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	31
PID 2292 wrote to memory of 2580	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	31
PID 2292 wrote to memory of 2580	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	31
PID 2292 wrote to memory of 2580	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	31
PID 2292 wrote to memory of 3016	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	32
PID 2292 wrote to memory of 3016	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	32
PID 2292 wrote to memory of 3016	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	32
PID 2292 wrote to memory of 3016	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	32
PID 2292 wrote to memory of 1608	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	33
PID 2292 wrote to memory of 1608	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	33
PID 2292 wrote to memory of 1608	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	33
PID 2292 wrote to memory of 1608	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	33
PID 2292 wrote to memory of 1984	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	34
PID 2292 wrote to memory of 1984	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	34
PID 2292 wrote to memory of 1984	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	34
PID 2292 wrote to memory of 1984	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	34
PID 2292 wrote to memory of 1696	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	35
PID 2292 wrote to memory of 1696	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	35
PID 2292 wrote to memory of 1696	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	35
PID 2292 wrote to memory of 1696	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	35
PID 2292 wrote to memory of 904	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	36
PID 2292 wrote to memory of 904	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	36
PID 2292 wrote to memory of 904	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	36
PID 2292 wrote to memory of 904	2292	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe

C:\Users\Admin\AppData\Local\Temp\1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe
"C:\Users\Admin\AppData\Local\Temp\1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0dbN.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2292
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2604
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2580
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3016
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1608
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1984
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1696
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\services.exe

Filesize
45KB

MD5
fc04ee8fd24f7b363731651f601b4cf0

SHA1
54b37e1124d1a95b3786fb63acbee106b210d3ad

SHA256
1c9d590072ecd4210edae3f2b91b1296695f18d56b7b98efa944c637ad65f0db

SHA512
93a38c2b3b5e8fc23cc4d77131da7ee06d6d1ea4eefb5c07cf9604d71a16044a1f3e4fc1b702c9cdbd91d92be57baa6d08ab1d6da42f885649e62eafe654e26f

Download Submit
C:\Windows\xk.exe

Filesize
45KB

MD5
ef4d0985891bf5ee72a2c9f53810b927

SHA1
004d308a923d8caaa790b64939bbb208c0f8b217

SHA256
35dd37f8a70ab2ddd95c2843900ae0b4d72822ea2bde2ecab49568eadfb5d319

SHA512
62d4ab58a7ab79adb5d74e7729a6238e328bf529eb97230f4ab0e5b926a6c8f7201f015c637b32142e52e699b660a243b4afaf0e4eca02c7763194a8bcf11f48

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
45KB

MD5
df8ea7482d3c74472ec35bc0941e56cb

SHA1
f9f19b35340e7abe8dd97d96f73313e7847abd2c

SHA256
a529566318d43bf810ca1339f172bfdf985378706ec08cf5879c371fd2e695e4

SHA512
3fee036f0dde05aa2c653c8042504fe835a8149f0234aec291762de9276f0df74ae205c42198bb6bc9b372454e339c391485c0d6a7f43302d723fa74c52e26df

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
45KB

MD5
edcd26d58ce019c8f19f417d5e8717cd

SHA1
0c94deb76562a92e4d60fe6c1748eeb3f6110318

SHA256
e8c468a2b1296e44767c2d8766ff008e7a5af519adca4d35ac0912c68a97fc2f

SHA512
b1edcc949f9a755e2174fac241259695e154022918b7ba4692e9ea4b9af096e25842e92013461ae7f11034d72809b4592065a1325d5da508524bf6f78647d2e2

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
45KB

MD5
634b0a26983fed0ff2976d8c8017abdf

SHA1
9a249f541f4d5db780a45c1378597810e5e1b2bf

SHA256
c15ba2a08f6424e4efd475e170ed5089ea9e850fe75eb2c0b6c08e3d6cc80cfc

SHA512
212327cb96d8d3f4cb22d1631d54081677dc47a3c0697d26f353d630da349d3f13e3ec4fbd5c48b3556d7f90a6a8bdd110d6afa7bd84b80c26c2c69b3209e7be

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
45KB

MD5
e868016f173775f072c30ef3dd1ffcee

SHA1
fe92c21071c5703a90555c4d91a4656c7bf238bc

SHA256
9cbfba84e7bd5951c02603c17d825a39eae447a23f07245774e142137842577a

SHA512
3e716898f25407ac329e9416be887572ae996980c53c8fc32f64f0079fd25f772f7ba6c209ca897505c6b289b6f568af4a113b2da0aac63db9310f53cddb428d

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
45KB

MD5
9982dcee2f139a22cdecea9890863ca0

SHA1
14a2a8cfc436c7ea2e91f4ef736b797b8df3b371

SHA256
cdd25c1a7f90d52d7a5752e53371a5777bd623f8937caea27a64a463112647bd

SHA512
154cb0df35d06a062633251d5f136f11a0fbaee36921b1e992eb31dff87cca9370e8c4418741e8f37bb3ee9b34eb9a1184d633d54aac50181e0a50bba0416954

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
d046a4a67361cb035c125f262c8798a7

SHA1
cf276ebab0983f5b518a34ed150e3b6b3a719346

SHA256
27585ccaab83f52c4109683b3f3c0fa21a098627ee44541059c4406290f01fd5

SHA512
c06402eee894c36016352e107e015dfd0087c0f560eb1af0253821ea6a32fd0bb791068c038f6d1480b6e1efcd5d61f896c4d1bba0311ea5ca19b302f2a59aab

Download Submit
memory/904-188-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/904-185-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1608-154-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1696-177-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1696-174-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1984-165-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1984-163-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2292-133-0x00000000026E0000-0x000000000270E000-memory.dmp

Filesize
184KB

Download
memory/2292-109-0x00000000026E0000-0x000000000270E000-memory.dmp

Filesize
184KB

Download
memory/2292-108-0x00000000026E0000-0x000000000270E000-memory.dmp

Filesize
184KB

Download
memory/2292-143-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2292-159-0x00000000026E0000-0x000000000270E000-memory.dmp

Filesize
184KB

Download
memory/2292-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2292-189-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2292-134-0x00000000026E0000-0x000000000270E000-memory.dmp

Filesize
184KB

Download
memory/2292-172-0x00000000026E0000-0x000000000270E000-memory.dmp

Filesize
184KB

Download
memory/2580-128-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2604-116-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2604-111-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3016-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3016-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download