757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278be

Analysis

max time kernel
119s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
Size

347KB
MD5

889ce0232dcca264fc7357f0428bc2b0
SHA1

8417625f2d111b6f67be17624ec9d8d682383845
SHA256

757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278be
SHA512

31aac782312ebf21ef21f59966b0c23112df3982cc97ed652a68751c370316099489e8524ea9ab96b435b54fc9b143965c3e8321a24dd0a403154eea3326daf4
SSDEEP

6144:UY+32WWluqvHpVmXWEjFJRWci+WUd20rUU5EYCTvaBju4U:/nWwvHpVmXpjJIUd2cUusvalxU

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\\JYH1R8Y.exe\""	system.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023c9e-146.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 5 IoCs

pid	Process
228	service.exe
3940	smss.exe
4804	system.exe
3632	winlogon.exe
4924	lsass.exe

Loads dropped DLL 1 IoCs

pid	Process
4804	system.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023c9e-146.dat	upx
behavioral2/memory/4804-319-0x0000000010000000-0x0000000010075000-memory.dmp	upx
behavioral2/memory/4804-332-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sFM2W4F0 = "C:\\Windows\\system32\\LGE7L3HHMV6R6P.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0R8YMV = "C:\\Windows\\CFO2W4F.exe"	system.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\O:	service.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J\LGE7L3H.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\LGE7L3HHMV6R6P.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\LGE7L3HHMV6R6P.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\RQU2C1M.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\RQU2C1M.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\RQU2C1M.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J\LGE7L3H.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\RQU2C1M.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J\LGE7L3H.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J	system.exe
File opened for modification	C:\Windows\SysWOW64\LGE7L3HHMV6R6P.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\LGE7L3HHMV6R6P.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\RQU2C1M.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J\LGE7L3H.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J\LGE7L3H.cmd	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\SysWOW64\LGE7L3HHMV6R6P.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\DST3X4J\LGE7L3H.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\RQU2C1M.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\LGE7L3HHMV6R6P.exe	lsass.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\CFO2W4F.exe	system.exe
File opened for modification	C:\Windows\HMV6R6P.exe	system.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\JYH1R8Y.exe	system.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File created	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\zia02956	system.exe
File opened for modification	C:\Windows\cypreg.dll	winlogon.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	system.exe
File opened for modification	C:\Windows\HMV6R6P.exe	service.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\WCW2D0T.com	service.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	service.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	winlogon.exe
File opened for modification	C:\Windows\lsass.exe	winlogon.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	service.exe
File opened for modification	C:\Windows\HMV6R6P.exe	smss.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\HMV6R6P.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\moonlight.dll	smss.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	service.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	service.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\JYH1R8Y.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	smss.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}	service.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	winlogon.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	smss.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	system.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	winlogon.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\JYH1R8Y.exe	winlogon.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}	smss.exe
File opened for modification	C:\Windows\lsass.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\CFO2W4F.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	winlogon.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\JYH1R8Y.exe	lsass.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	smss.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\JYH1R8Y.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	system.exe
File opened for modification	C:\Windows\lsass.exe	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	winlogon.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	system.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\WCW2D0T.com	smss.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	system.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\WCW2D0T.com	system.exe
File opened for modification	C:\Windows\CFO2W4F.exe	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
File opened for modification	C:\Windows\HMV6R6P.exe	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	4804	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
228	service.exe
3940	smss.exe
4804	system.exe
3632	winlogon.exe
4924	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 228	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	86
PID 4040 wrote to memory of 228	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	86
PID 4040 wrote to memory of 228	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	86
PID 4040 wrote to memory of 3940	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	87
PID 4040 wrote to memory of 3940	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	87
PID 4040 wrote to memory of 3940	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	87
PID 4040 wrote to memory of 4804	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	88
PID 4040 wrote to memory of 4804	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	88
PID 4040 wrote to memory of 4804	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	88
PID 4040 wrote to memory of 3632	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	89
PID 4040 wrote to memory of 3632	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	89
PID 4040 wrote to memory of 3632	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	89
PID 4040 wrote to memory of 4924	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	90
PID 4040 wrote to memory of 4924	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	90
PID 4040 wrote to memory of 4924	4040	757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe	90

C:\Users\Admin\AppData\Local\Temp\757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe
"C:\Users\Admin\AppData\Local\Temp\757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278beN.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
  "C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:228
- C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
  "C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3940
- C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
  "C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4804
- C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
  "C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3632
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\HMV6R6P.exe

Filesize
347KB

MD5
a98b07395c13245f3d91dc2f8eae4ff3

SHA1
8bbc92da81a93f27179618c59f523610de64d522

SHA256
02e72c8b59852011877128ccc5f1265101f36b5964b679a841e1fc5cd795a318

SHA512
1b0bf099f54d4c3c2287b04ca21f0180e585824ac93be174a89b5261077414e3ef826d148d70df5fdb2809e602673f37c8036d5206f712c1e18034915102804c

Download Submit
C:\Windows\SysWOW64\DST3X4J\LGE7L3H.cmd

Filesize
347KB

MD5
d6c351a7e082728bf94ca26495e79095

SHA1
33c8944c4ddab4343db628648636a66b17ec126a

SHA256
2734aa930e473628d2335a94615457a4f98bd223b1e5ea8bd63e5f92fdb12210

SHA512
542c12f740860338f8ed9a91939f947780ab0ea4a3ffcd1ffe37ea2d5c2017557958e966f297f1363c3388b8e21c3a763894a6c06d9684a9c74b3e59f9a679a7

Download Submit
C:\Windows\SysWOW64\DST3X4J\LGE7L3H.cmd

Filesize
347KB

MD5
33b8e81246275bf2e10a37d432532589

SHA1
cb8cbb6477354caf2a1fe1bb83ed38e646b0d438

SHA256
6d77dd2f6adcaaa71b9bd5b22210520e495ed20c607abf03cfd986034ec67255

SHA512
a6c0a0845a9b945a785ff41cc9b44165c237c5ea6aa3b7ec216a275725a7765108ace45d65d8cf9ce60a887b88f4e50d74cb7ce6d55469fc54a1883ebc579e34

Download Submit
C:\Windows\SysWOW64\LGE7L3HHMV6R6P.exe

Filesize
347KB

MD5
359bf3eb5c59cd00711bc57d572ef001

SHA1
1c0d708f261380f84057bdfd63dd29ce26a90069

SHA256
b9fda9e98af047ce549fd6a5498ada74b45313fa98d5d0aa8431bdb13367510f

SHA512
8b2493ded5c935bd53fbfc878c707316ef3c7bf94d3ad6cd3221ddfcc62b8413a4cb85614431acf2736aecb5a28ea4900f074132e67dbd11fff2102b492b1a08

Download Submit
C:\Windows\SysWOW64\RQU2C1M.exe

Filesize
347KB

MD5
aa5c92a9774d4200d40bb0bcfb470f6a

SHA1
6d58cf0b0e700970da8d5d39a989ee4f34a15b0c

SHA256
f94b4f725e056a8293d384f414b7915997dc0e7ad196a9a9532bc315e1e1419b

SHA512
a9495307e70c0fdc64df5e74605f464086a62569555f7382ff8d4414dc05d190c2485475765e26190a328016196933668ea339f16944d67c75c3d271228e4441

Download Submit
C:\Windows\SysWOW64\RQU2C1M.exe

Filesize
347KB

MD5
ac64cd56c5b6862ab569ecdd88835684

SHA1
4734d45d26b25782aa859771129bb8e58cd32eea

SHA256
78a4bca7b262d2767c3ca2cf1816f663e9bef06b45c1426064ac721ca034ca1d

SHA512
a911f220092f0fde04cf13c853f2ba96c47252ea3e76e111a1775c920a9b3c32c4922cf0dd28ae8a25e67417c141b7d542bebd3ed305da2ee85b0cab75b609eb

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
6ddb4c8353abf18bc212e17ceb465a84

SHA1
8fb64e3bfca4fc4f6fbaf6e91da5c455c21c30be

SHA256
502d28c4bf9813d1601673069e1e33f5618757bfa014f91c85c4e02823f19110

SHA512
710d98727328400380962701eb3bde8fe7b9f865bcfe981d069d7dac4e75704dfab6b78a1abffea6dce4c74539d360c61def6041d5e050087887cf12b7dde3e1

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
aa01443085dd05cf9f2d6c0eb2d82298

SHA1
4db081e994527bcceacb5ed9add75dfb9f35d0ff

SHA256
2617a92175fb1b203177f62ddf029ecf4dafd20c6bb97a29421396df2c92ce6c

SHA512
7d64e864366f9dc4da4eecffab0801b5098b809813888e185dc24ac988678635a6ccd21f640e1f9d291a94b2b8c2a44eeeb846f766320dd1b867b318f0f38e3f

Download Submit
C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\JYH1R8Y.exe

Filesize
347KB

MD5
889ce0232dcca264fc7357f0428bc2b0

SHA1
8417625f2d111b6f67be17624ec9d8d682383845

SHA256
757d363083bdf22b5ebc8f646da24db0abde579635b6200ea5e71f697cb278be

SHA512
31aac782312ebf21ef21f59966b0c23112df3982cc97ed652a68751c370316099489e8524ea9ab96b435b54fc9b143965c3e8321a24dd0a403154eea3326daf4

Download Submit
C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\JYH1R8Y.exe

Filesize
347KB

MD5
ae5e98b2642fc921a584dd0d135c816c

SHA1
e2654478733ee30b7f66c9e31fc7b181e686af44

SHA256
7edb6d07aa1bbc4afcbcd700b1afffd5658b74ea952940e554be63fa8b404fb9

SHA512
0917d079295399476e04b75eb5046832255c96d6aad04259b752e6e9bc4a651b32d458b04f6d1994f2605e9a45ff792f374d5f1de03607289f9d1e5afe77b580

Download Submit
C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\JYH1R8Y.exe

Filesize
347KB

MD5
d75824cc54488e1443827440c8078f0b

SHA1
1d80d51ef07c1ca1b1b5c412cfa72e18fa9730ca

SHA256
85b3bd1639b2281db3e8f10fb4e8fcd695f6862d504fe4b9b76297d03d6822f6

SHA512
73924bffdb2060a118db53609161b7891fa3c0d2d4a8a21c8b795258e47c1a7893bff9e759f7e92b8f8d56d72c8cbe612e566cdbd69b8fe0e540c58f61752563

Download Submit
C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
347KB

MD5
012ed4cf535a6350e6437aff624b8c0d

SHA1
e1f6c0c2ce5b6ca3fa3261f23b35cbe92945999f

SHA256
a69972fe2e8fc16e94ce01238f7b43f84fadcd2bdf0c18ffeaffae8573f10008

SHA512
3caae90ecec9eed99ba586b2a7a7b54cfcdbb740f4693e742b9ec7b1c08bf581cf8b02317afb9c436198030064304cbe0068bafc6257d7bfbac00c5478a33827

Download Submit
C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
347KB

MD5
15edca481136080fed6455654181f44a

SHA1
47cb5c0685c4d87856c7b161e5b7980e0608d9ba

SHA256
986034f05d56ce6502d17860809cee0e24fc888bd76c55ec6b12001cfe769414

SHA512
02960e4ce8521f617096643bc75f2fcd53f206f62edafaa16178d2b302bcbf02562b061850f398caa8b10190b206a60af612629ccfffb569082d33296f668697

Download Submit
C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
347KB

MD5
86ea8f7e0cf9c98a2d7e8511dd438139

SHA1
58f6529cea5521d2f4e6220e4bf67dfa4120a0a5

SHA256
97e1c743608d2dab3058c0fa19937d1321a023fb1bcbd6e9a3c481907af4f6eb

SHA512
2c05736dc568b06ef73644480a023e6af55fabefeb5ba1fad6a3245aa1a0b4fbc691f526776ae74243a4c7d66328966eacc9012cc261afa903c8d1e4169f8e4e

Download Submit
C:\Windows\XFM8N2Y.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
347KB

MD5
94ab3d14ca64ec5ebc0c155cc78ca596

SHA1
806866798b51453135cad3d5bf0051a33dd233c6

SHA256
00723bdc20b4eada77cad09845c0d2917a1222c01747a7b5285e6e03dfefb8de

SHA512
8868253ae1ae5eee2e3d28dc937cda13868b5a92215e8841fe8df7fdec2f8feff8886ee1c95f3d830b3b40e446b265ad19a113e2ac15bb2b0fec342b7a827444

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
e311ef4df4009a9926e9d774568ad810

SHA1
8b546b1b626a28a4b117359065e43d5217cb9cfe

SHA256
dba59c4d0417da694c70255a4741b94c92bd6206b932870b4d1b8eefe7fbd9b8

SHA512
597399a7c5cb4b34de5ce070ccd2c2684bb601dded6456eb0bbd7a0cd13d0d4cefbbdc3a9a445840f033a49ec2554c46764535e115897623476ab6be64a89452

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
0465802f99a2971dbc61fbb19a8ac1fe

SHA1
d282f13fa629c144620ec2bfee64347c5d9140ee

SHA256
b26b7b79e0c1ddc76a0a245b670b5e9d635abeede20ccf6bc5d883301a888d60

SHA512
b9b54f3e1168ba8e966f7747ea440d9d98d9fc66d250c70ebdb3461c372db89d07295f1ad086f9fe51f75f5bf74902da3b13bdfca4affbf4bcd3dd57fbc167c4

Download Submit
C:\Windows\lsass.exe

Filesize
347KB

MD5
9e9e6ee4404f503eb4f74e2720c59edc

SHA1
c4f437b93d6b2e7ff66d28a3e12587a143fbca98

SHA256
3ec763ee45ed5347ecb75c12dbc4327140319235f255bac72a151dac27c7b443

SHA512
15f401c5e5df05c2610611cd3227739b20799dfff6cb1d9815e63df9198426faee7f2194be759f7b7030e2efc477cf0c6be4b92fb473b057853f7978d2159c67

Download Submit
C:\Windows\lsass.exe

Filesize
347KB

MD5
c720cbca37f24381eb7ea4d7a65f7c34

SHA1
04127eff5f9328b55ddeeb124bb9825220c49c4d

SHA256
202756f7a886f84c778167bf23b075c8976f4a45ace83fe28a29d372aea25fe7

SHA512
7823a15047096e1d3c1614a86a93ad08ee9283661e984ec01cdc56de47fc9615995855d8da0fc9342f9b12caca1293ecc37101a6dc8395672d232c01e2df162b

Download Submit
C:\Windows\lsass.exe

Filesize
347KB

MD5
da9cde5b30079f9f973497982e8e5daf

SHA1
3072dc2fec0d27beb8c979978be510118cff0fa2

SHA256
7e40bb54ac0b01cf0855520aea2de19888d64145fcd5eb14b37097907e595698

SHA512
ff5304a111b48377ca0d6cbfbf7b960d49c4579def44c8de8001c9b073a7da2eb69dbeb5250274e76afe6049253bca874234f401804a02e7fbb7da3110cfdd72

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
8d205ffd6d88ed41b19caa91a7aa994c

SHA1
5ee0cc6ef7ab500ffb99e42323fe5074b52cce91

SHA256
7500ef088d9a7f141d896bdcc21fc38675dc4763a301d657107ca9622f74ca99

SHA512
8462003ca9aead0737789bdd8a769608e6217e80c82264b439a1d649bc185880220959f9c4b2578cd0467fbca9409bfaeedaf1ab13e70e3a545eb11b239bb68f

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
f45f8d9fa3e4b3cec0d13e83ab9efaee

SHA1
05a098f8a554143aabcdb839afd82d5ca3923b55

SHA256
e13fb59a98f3d4bc9f1826c79dd36e53b587b7353823dd952183f0f3502725da

SHA512
71c2bf5214e36d1d38726a466b43e8e43319e47ca58483e18ee71d289baa4198f9d6a271e5a9cf66fdfbbdabd3dfc31768e750a262fd008f5bc3fc1eaca3caad

Download Submit
C:\cool.exe

Filesize
347KB

MD5
8fcf97c1f25d5274b73167b10c106466

SHA1
f936f0447b940421421a4beb1b47f95c30071494

SHA256
89152bd96f840ff8c6b273a60bdfc8338476aba9c82b5e7de1e23575fd3abc71

SHA512
ec34d8512b407d05e1398f16cf6b3328c8140fdf78fc6138b578a70d59b35adff4f6a35ce0bfdc2f3207a91ce4e3ad1724f860e3c05d78d0b968332cc61c4b4c

Download Submit
memory/228-57-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/228-309-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3632-95-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3632-312-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3940-310-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4040-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4040-289-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4804-87-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4804-311-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4804-319-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/4804-332-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/4924-288-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4924-318-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads