f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Size

91KB
MD5

99583bad9b5a5a950f175e054b42d4b3
SHA1

0179a7e86748547d6460ec0c4b1c5e094fe7d03b
SHA256

f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839
SHA512

5394a66293cc54ee93315d09c1d7ba6b5c948a47ddd958ef773dbee25e05d3c2d35d9d41de8fa5274b0ed155bf5c1b2b48aacd72b1e966e87ca6fb694848b624
SSDEEP

1536:XJRtlEnBHHIgabuYotV/JbJCX5SBixJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIxvtYxOuYotvYQIE

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 13 IoCs

pid	Process
2124	xk.exe
2548	IExplorer.exe
1940	WINLOGON.EXE
2644	CSRSS.EXE
1828	SERVICES.EXE
884	LSASS.EXE
2340	xk.exe
1876	IExplorer.exe
1344	WINLOGON.EXE
2440	CSRSS.EXE
1236	SERVICES.EXE
2212	LSASS.EXE
1520	SMSS.EXE

Loads dropped DLL 22 IoCs

pid	Process
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	C:\desktop.ini	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened for modification	F:\desktop.ini	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	F:\desktop.ini	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\I:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\N:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\U:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\V:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\Z:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\M:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\Q:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\S:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\W:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\P:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\R:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\X:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\E:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\K:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\L:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\O:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\T:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\B:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\G:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\H:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File opened (read-only)	\??\J:	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\shell.exe	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	C:\Windows\SysWOW64\Mig2.scr	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\shell.exe	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d9c-8.dat	upx
behavioral1/memory/2112-106-0x0000000002680000-0x00000000026AF000-memory.dmp	upx
behavioral1/files/0x0007000000016fea-111.dat	upx
behavioral1/memory/2124-114-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018b89-115.dat	upx
behavioral1/memory/2548-126-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018bbf-127.dat	upx
behavioral1/memory/2112-140-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1940-139-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018c8e-145.dat	upx
behavioral1/memory/2644-148-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018cde-151.dat	upx
behavioral1/memory/2644-150-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1828-159-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/884-173-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/884-176-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1828-163-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018ce8-170.dat	upx
behavioral1/files/0x0007000000016fea-231.dat	upx
behavioral1/memory/1876-243-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2340-242-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018b89-240.dat	upx
behavioral1/files/0x0005000000018bbf-246.dat	upx
behavioral1/memory/1876-254-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1344-259-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018c8e-266.dat	upx
behavioral1/memory/2440-269-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018cde-272.dat	upx
behavioral1/memory/2440-275-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1236-297-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2212-299-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2212-296-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000018cf2-300.dat	upx
behavioral1/memory/1520-310-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2112-466-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\xk.exe	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File opened for modification	C:\Windows\xk.exe	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E5-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F8-0000-0000-C000-000000000046}\ = "StoresEvents_12"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304E-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304D-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063094-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DB-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067355-0000-0000-C000-000000000046}\ = "_OlkSenderPhoto"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063042-0000-0000-C000-000000000046}\ = "UserProperty"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E7-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CE-0000-0000-C000-000000000046}\ = "_RuleActions"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D8-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063099-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063086-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063097-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EC-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063039-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E6-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EF-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DD-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E2-0000-0000-C000-000000000046}\ = "OlkCheckBoxEvents"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EB-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E6-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CD-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308D-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300B-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067367-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A0-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063094-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304A-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DF-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303C-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DA-0000-0000-C000-000000000046}\ = "_ImportanceRuleCondition"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302C-0000-0000-C000-000000000046}\ = "ApplicationEvents_11"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DB-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063046-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308D-0000-0000-C000-000000000046}\ = "_Views"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E2-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CA-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063076-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300D-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EC-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\ = "_ContactItem"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303C-0000-0000-C000-000000000046}\ = "Attachments"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DE-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302B-0000-0000-C000-000000000046}\ = "ItemEvents_10"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300B-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063074-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DB-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309B-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063071-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067353-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E8-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063075-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305B-0000-0000-C000-000000000046}\ = "FormRegionEvents"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EF-0000-0000-C000-000000000046}	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1568	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1568	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1568	OUTLOOK.EXE
1568	OUTLOOK.EXE
1568	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1568	OUTLOOK.EXE
1568	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
2124	xk.exe
2548	IExplorer.exe
1940	WINLOGON.EXE
2644	CSRSS.EXE
1828	SERVICES.EXE
884	LSASS.EXE
2340	xk.exe
1876	IExplorer.exe
1344	WINLOGON.EXE
2440	CSRSS.EXE
1236	SERVICES.EXE
2212	LSASS.EXE
1520	SMSS.EXE
1568	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2124	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	30
PID 2112 wrote to memory of 2124	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	30
PID 2112 wrote to memory of 2124	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	30
PID 2112 wrote to memory of 2124	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	30
PID 2112 wrote to memory of 2548	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	31
PID 2112 wrote to memory of 2548	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	31
PID 2112 wrote to memory of 2548	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	31
PID 2112 wrote to memory of 2548	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	31
PID 2112 wrote to memory of 1940	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	32
PID 2112 wrote to memory of 1940	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	32
PID 2112 wrote to memory of 1940	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	32
PID 2112 wrote to memory of 1940	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	32
PID 2112 wrote to memory of 2644	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	33
PID 2112 wrote to memory of 2644	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	33
PID 2112 wrote to memory of 2644	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	33
PID 2112 wrote to memory of 2644	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	33
PID 2112 wrote to memory of 1828	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	34
PID 2112 wrote to memory of 1828	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	34
PID 2112 wrote to memory of 1828	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	34
PID 2112 wrote to memory of 1828	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	34
PID 2112 wrote to memory of 884	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	35
PID 2112 wrote to memory of 884	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	35
PID 2112 wrote to memory of 884	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	35
PID 2112 wrote to memory of 884	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	35
PID 2112 wrote to memory of 2340	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	36
PID 2112 wrote to memory of 2340	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	36
PID 2112 wrote to memory of 2340	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	36
PID 2112 wrote to memory of 2340	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	36
PID 2112 wrote to memory of 1876	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	37
PID 2112 wrote to memory of 1876	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	37
PID 2112 wrote to memory of 1876	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	37
PID 2112 wrote to memory of 1876	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	37
PID 2112 wrote to memory of 1344	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	38
PID 2112 wrote to memory of 1344	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	38
PID 2112 wrote to memory of 1344	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	38
PID 2112 wrote to memory of 1344	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	38
PID 2112 wrote to memory of 2440	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	39
PID 2112 wrote to memory of 2440	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	39
PID 2112 wrote to memory of 2440	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	39
PID 2112 wrote to memory of 2440	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	39
PID 2112 wrote to memory of 1236	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	40
PID 2112 wrote to memory of 1236	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	40
PID 2112 wrote to memory of 1236	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	40
PID 2112 wrote to memory of 1236	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	40
PID 2112 wrote to memory of 2212	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	41
PID 2112 wrote to memory of 2212	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	41
PID 2112 wrote to memory of 2212	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	41
PID 2112 wrote to memory of 2212	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	41
PID 2112 wrote to memory of 1520	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	42
PID 2112 wrote to memory of 1520	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	42
PID 2112 wrote to memory of 1520	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	42
PID 2112 wrote to memory of 1520	2112	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe	42

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

C:\Users\Admin\AppData\Local\Temp\f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
"C:\Users\Admin\AppData\Local\Temp\f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2112
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2124
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2548
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1940
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2644
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1828
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:884
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2340
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1876
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1344
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2440
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1236
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2212
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1520

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
c0e8b4334b8ec3d5a0d21ecf9f711cae

SHA1
3d159f320df89f68baabe80ad3edc2346f0e35fe

SHA256
6e6abfb8ed0bd4fc3102a0eec91219f051e8630b015801f3b4c4d720abbd5bee

SHA512
d57cb3597878e7a546759fff78e92792fb2b46ee4b220db4d11fd9e12a452d19728c29a130a535330bab56ae6f57d0256594fce8f799778e52b40d08680e1679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
235KB

MD5
491765652386343328bcd4e0a30ebc2b

SHA1
9dbd72d4e4d61f408e8fcf0fa6b2db08198fd8ee

SHA256
e719c0e9ced9e1e75045f439a8611ca48af90a7b7c03f2d8a6e75e96f47814d5

SHA512
551746099f66b963be7367aa8193685860ea11b4a96fc27d6d9e2a04279213de22d4dd7c5231dcf7a92ab80ceb807d1d98a4d6ba36a51089fdcfb99cbf6c4936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
235KB

MD5
1d2fe883a23da7d9fae279c3386332dc

SHA1
deb17b7ff97d5a40e44005c79507e21c21ce48e7

SHA256
c70066ea39641d99e326978b5994ab37bd9b4f146c1460070e76e9708fc0edef

SHA512
0fcb88ea04ad8b84384717bdcaedf5094ba47eb81a00deb683ed6775fbfb7e27b5ea7a834954ccad9fa8d17b1a1619a07cbee020e2eebe1021659519c4706843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
02e6e25b3671159d5692f5f3ae7a6eb2

SHA1
615cdca62b009f4f80f3b23123ac32df270eb677

SHA256
9a7f5a97322a91b93b4312a5b7667b3d92ee95521aabb55ff60ef97c08876c35

SHA512
3b98f4a4ce04ba18b54cc1a51cb16b44fa639fa5839da063c7db826e35738a4f28b0ce02cf8a8535dde85cae802e5d1244f99d6cbb2bbf0521264926b9121579

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
c1c1f1af4b2f7910d32c1f38d347004c

SHA1
d99003f741bc0a38db3a18f6c9e01b9704f76fb3

SHA256
99b933488a9a0e5db0dc1fa78676f3704046e2be1b3285b3e4baca3b2c5dfecb

SHA512
b8a085619f12955f207c33da2374a92173dceb7094b57f000502c6cf727e5ef26ba4a70a8f3a8c2774cb88d81c209a832ddb57a6246022baa3a2ff1719fb2c31

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
a437baea036c7bebaef2fd073f3fc670

SHA1
c87a92de97feca218a99e586f081d412dc65b38f

SHA256
aa1be722ff5198a64ee72da192d182a8728aba3d1f415c518af5c9eefe7c287b

SHA512
2a978a8c1432cd0284778aebc32ce094329e811d3183ec01e1f0efa87a25eb6ed492fe8ae1606e5dad14a791f0b3f7ea518ff319fc076ccae2bab406ae906d48

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
91KB

MD5
99583bad9b5a5a950f175e054b42d4b3

SHA1
0179a7e86748547d6460ec0c4b1c5e094fe7d03b

SHA256
f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839

SHA512
5394a66293cc54ee93315d09c1d7ba6b5c948a47ddd958ef773dbee25e05d3c2d35d9d41de8fa5274b0ed155bf5c1b2b48aacd72b1e966e87ca6fb694848b624

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
60a7873a9d653e7ff243fd397f5ac88e

SHA1
22e5c1c3dc70efa4f6c1771b0a65306d754630a0

SHA256
dfce4ac760eb42bdc1714216b34982ad46f59ec33d01954fbe2bdad71a1f274d

SHA512
8d4ba42c4e8ded63856c35513f42c4e30ab4a760e8c18cfdd5d381b35e22f76af8ab332ee132889ca42f139e734bb79fa150efef5639dee927b89c65d7291d41

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
fa1bca73f422535e76d6a6e828adaa7d

SHA1
7a24ff67c2feadccb74c6bb3adfbe9f97ba3b733

SHA256
1ebc139315332404a283ae46950b0276de0b767832b7b455438d9d8cae483c29

SHA512
cf147197419761b23d671d99706b5f6f5070054cc27e321a6b759b0399fb13cd74cef9393c022308732451ed5d18090970dfb4a0a9962812cdbbad8ccc3ca26e

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
bd4a71d43b4afeb21df26a3bdca2e277

SHA1
501c54eef73e469a84b20652e54fec64c0272583

SHA256
68400676a74525437789b6cad888664a1124bb98526778547b710d47b05b6759

SHA512
802a8ac2986dcd93c2ec2c5a8afe95100d63e9f2b9e618e6a93a176c7d2ca76d856dea51d118f2bbd8428c928de46719c81174b45af10212e8eb072218532236

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
c5eebd0c9601a36206ea9d72270cd1f8

SHA1
6b60a01c30548992fd84389c808078eeb71244bb

SHA256
12e87690dcee7abe99b3a56b0398c53ce13d135c62670e65ba83b6b1df595043

SHA512
1ad37a307db0b73a38107c58cb5b702bde6b4ed2e1e4366d1662743d95609c430cf1ab01d986f23c809c3e1632fd819bcec3de275ed0f468c8bcef328e1c83db

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
5bc212ecd07c5e5b7795509fe61c3e9b

SHA1
e31e03028bc9de0f4daa7e201159057ede300c5f

SHA256
e6a3497a2921cbbffdc543cc5dca0ef70679fac85da5e65722aab563b09ba2ae

SHA512
f4b3376b8cc8edfe1db76c31a78f10cea1ffc1e3947a494a7c4d678182eeacf70dee25bdde932dcd6f685bc1bb77d90a71f1e7efed6bdcc8055c2a14dd7de69f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
73b511b29d821e66a58abcb2d444a51d

SHA1
1e3f1126187ab0b39cbc3d2f80cad8d979469072

SHA256
dbe80f2bc785d9ddbc112f2ab404eb382340183b62f448ae996afe7c9d8b45eb

SHA512
87f6c7d90c1cbf8f9916a3ce902f4b9e639251ea6fc89b637903e2fbadd2829a8cadb28767c1ea76afe177ed8bfe9ac86a1ff93231f4c992789d96ffc458f524

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
518960c8487e3ff6621b1dbca1344fe7

SHA1
436e283360d1ab2c5babf1e9f50ee318a48a0b08

SHA256
9814be84fdff4043230d34687020da4e77865a8cc48cf83c2d3bba2c53acd5e9

SHA512
a56f06c64501b21326400fedba54e67a8778bfb2794ec2544e045d54076b7d90721cbc52a439b55fdea7bbd23ee20641b1ae1a8c58d325d4f30246582fd0af8c

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
77273a017934b0ae624961d7ccb15dda

SHA1
aa6cc9c041d1ec64b81db89dac32289c018c8796

SHA256
e9914aafb0acdcd104bc414000d849385605d09af2e38ff4126868aa31dc00f8

SHA512
e91c96bbf6bb26bf1f2b73e8ca93dafe5c4ee8ba66e33cb92b20edfab8c8a4f67d798176080626c4a780887a1664fcab0822dd9bf1673c055f2ad47b5a631a29

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
4ebf6dd5fe18f9bf43c2b831e8272306

SHA1
b335301b970b8b306f91248c6156f1834d31f90e

SHA256
cfcea0a36a8ff1618f329283d58ee87fdc4a789fe021a078e1606efced3f5d3a

SHA512
1e16adadec15f6f336dc2d66e7ba02449286b8cfd54871d7422444f8ca827b4354f4be68cca336d57155a82381f916c64d3637a02e0a1316b60a6bf73b13d953

Download Submit
memory/884-173-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/884-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1236-297-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1344-259-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1520-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1568-335-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1828-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1828-163-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1876-254-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1876-243-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1940-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2112-280-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-281-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-172-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-157-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-268-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-267-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-465-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-440-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-464-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2112-255-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-230-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-437-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2112-394-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-466-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2112-295-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-122-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-106-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-110-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2112-392-0x0000000002680000-0x00000000026AF000-memory.dmp

Filesize
188KB

Download
memory/2124-114-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2212-299-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2212-296-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2340-242-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2440-275-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2440-269-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2548-126-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2644-150-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2644-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download