e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Size

45KB
MD5

d1ab10ce6846f8d4ad0596d76f690070
SHA1

61d21a46bdab224edadc00d51dad6300f5a069fa
SHA256

e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452
SHA512

d6b0a07f6c06edca52e6e61644fbbb17ecb138a265cbf831e1b0c5ffadc15782057b31f768799537d9afec0e365bc8dfca771d97dc91b8400615e0b13d6828e3
SSDEEP

768:kSxam3Usjr3RT594UPS8GGCMDDxW738HbFtnbcuyD7UVOQI5nof:kRsjd3GR2Dxy387Lnouy8VTf

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2516	xk.exe
1052	IExplorer.exe
236	WINLOGON.EXE
356	CSRSS.EXE
1268	SERVICES.EXE
2844	LSASS.EXE
1988	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2544-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0007000000016d27-8.dat	upx
behavioral1/memory/2516-112-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00070000000193ec-109.dat	upx
behavioral1/memory/2516-115-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000019441-116.dat	upx
behavioral1/memory/1052-124-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2544-123-0x0000000001CC0000-0x0000000001CEF000-memory.dmp	upx
behavioral1/memory/1052-128-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00050000000194f3-135.dat	upx
behavioral1/memory/236-138-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000019537-139.dat	upx
behavioral1/memory/2544-147-0x0000000001CC0000-0x0000000001CEF000-memory.dmp	upx
behavioral1/memory/2544-146-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/356-151-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00050000000195d9-152.dat	upx
behavioral1/files/0x000500000001960a-170.dat	upx
behavioral1/memory/1268-163-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2844-174-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2844-176-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001960c-177.dat	upx
behavioral1/memory/2544-189-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1988-188-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
File created	C:\Windows\SysWOW64\shell.exe	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
File created	C:\Windows\SysWOW64\Mig2.scr	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
File created	C:\Windows\xk.exe	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
2516	xk.exe
1052	IExplorer.exe
236	WINLOGON.EXE
356	CSRSS.EXE
1268	SERVICES.EXE
2844	LSASS.EXE
1988	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2516	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	30
PID 2544 wrote to memory of 2516	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	30
PID 2544 wrote to memory of 2516	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	30
PID 2544 wrote to memory of 2516	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	30
PID 2544 wrote to memory of 1052	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	31
PID 2544 wrote to memory of 1052	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	31
PID 2544 wrote to memory of 1052	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	31
PID 2544 wrote to memory of 1052	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	31
PID 2544 wrote to memory of 236	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	32
PID 2544 wrote to memory of 236	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	32
PID 2544 wrote to memory of 236	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	32
PID 2544 wrote to memory of 236	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	32
PID 2544 wrote to memory of 356	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	33
PID 2544 wrote to memory of 356	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	33
PID 2544 wrote to memory of 356	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	33
PID 2544 wrote to memory of 356	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	33
PID 2544 wrote to memory of 1268	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	34
PID 2544 wrote to memory of 1268	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	34
PID 2544 wrote to memory of 1268	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	34
PID 2544 wrote to memory of 1268	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	34
PID 2544 wrote to memory of 2844	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	35
PID 2544 wrote to memory of 2844	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	35
PID 2544 wrote to memory of 2844	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	35
PID 2544 wrote to memory of 2844	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	35
PID 2544 wrote to memory of 1988	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	36
PID 2544 wrote to memory of 1988	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	36
PID 2544 wrote to memory of 1988	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	36
PID 2544 wrote to memory of 1988	2544	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe

C:\Users\Admin\AppData\Local\Temp\e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe
"C:\Users\Admin\AppData\Local\Temp\e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2544
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2516
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1052
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:236
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:356
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1268
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2844
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
45KB

MD5
0098b82c67ec0060b07916bb73f34dca

SHA1
b41cef68f9f89c474bf4a31b850f614db509a39c

SHA256
6daa12316311e1231fa67594408017e1f63c5e8f057d0d746d051c97cc64e100

SHA512
7a4b7dc385014d4af675b9f0e2f8f80dbd6e17efd0bb7c08ced62c4756b2054f7edffb31ace168e160a60c263439e0032ac2a634340a923868bc38cb72611506

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
45KB

MD5
5f79948ecbd4071bd232972d1c014c06

SHA1
317a60634844de201fb1d0c74ded689e8dd8b3d2

SHA256
a97aab65666b6111158192e4857d6b7783041a214f7e1faf578d7345bff9074e

SHA512
7efae849d345a9f7c70d70d4165d7b467c813fcc9cabcb8af5d448876469bc6c643f083100890799c9ef8f034d31dd3ca85a55bdc29113139cf7fe0d6126567a

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
45KB

MD5
d1ab10ce6846f8d4ad0596d76f690070

SHA1
61d21a46bdab224edadc00d51dad6300f5a069fa

SHA256
e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452

SHA512
d6b0a07f6c06edca52e6e61644fbbb17ecb138a265cbf831e1b0c5ffadc15782057b31f768799537d9afec0e365bc8dfca771d97dc91b8400615e0b13d6828e3

Download Submit
C:\Windows\xk.exe

Filesize
45KB

MD5
30b2bc0a266e11b70c35769e353a7e90

SHA1
a929f881fe901094e347595bb3b62630b4014243

SHA256
b9b6773c22c5774a4880b3be70f9a41566ce7d58fce79b491538e7fdeff4f91a

SHA512
8a19310b416d02e2bf53aa1bc77045dcda5944afc4b6a32ff35a1bf3bf40844342f83e09ea29b34e77f60a6997438658bc2d837bbc3d106939b12fe204aa4ce8

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
45KB

MD5
aba8d8526808cf969eee356b209b3b01

SHA1
5e019ea150d0c8ba5368263cf579796062144fe5

SHA256
6a2c1f9ad2e9e69d2f73d250f1513132eb27759c16d337b5bed9818ec34389fe

SHA512
a391410464f82595c70d9eea9ba49d7cbf8722357307cdef52a9e033f65c823ef60df098a2bb7400b3b32bd896eda5ca579584819b2f416169ee6c2a51db80cc

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
45KB

MD5
a03c0a5ef4370251e46719b95c50ffd2

SHA1
d74926b939e061fd187322db209e032eb396491a

SHA256
a77e1b6571004fe118d81c61dbe21a6617f1d108d0319491d93f8faabcba5d6c

SHA512
efeac765d33dc698e58b6d12b9e86c1cd1db2553514e9e443d1c7703540e83285ad2ad16c9c4268f1ee059c2f8672e2f2fbc63a52d14aeda957437a40c8339e4

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
45KB

MD5
ab40845e4d98809d4d19334e594a9b68

SHA1
a0a8951b8e51eeb6ab82ce31c008453c3594200c

SHA256
6b2f22bb74b9d80a61778b3ab9bd4fe647378128896dabcee1b3686e6bbbe30d

SHA512
a6bd0f35fb1253b8e8c6508208eaa2d5bf32c3401d7112885a2182b480640a145308daf36276ef91c87615f75acbe1c356ec3de6e5a0ac79b99e916a15307a08

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
d85757b153d1fc9c292877af80696db6

SHA1
1506bb389d80d526e91f1ca229a087f2b84bcc4a

SHA256
0b7a8b8c7e8f9e4ad6521e1c7a03b658ce050c3900e22c972c1fd1e8bab84a97

SHA512
a098f1065903ed6a42b6018fa8d65315fe988ee0f33661501f34dcc1b061b639c1a01d8423e6f5ab33bc1c69d0674a8447a317c3592f6a7b0b9d46e1588a1fa0

Download Submit
memory/236-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/356-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1052-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1052-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1268-163-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1988-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2516-115-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2516-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2544-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2544-147-0x0000000001CC0000-0x0000000001CEF000-memory.dmp

Filesize
188KB

Download
memory/2544-123-0x0000000001CC0000-0x0000000001CEF000-memory.dmp

Filesize
188KB

Download
memory/2544-158-0x0000000001CC0000-0x0000000001CEF000-memory.dmp

Filesize
188KB

Download
memory/2544-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2544-110-0x0000000001CC0000-0x0000000001CEF000-memory.dmp

Filesize
188KB

Download
memory/2544-171-0x0000000001CC0000-0x0000000001CEF000-memory.dmp

Filesize
188KB

Download
memory/2544-111-0x0000000001CC0000-0x0000000001CEF000-memory.dmp

Filesize
188KB

Download
memory/2544-189-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2844-174-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2844-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download