65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Size

90KB
MD5

53f6ae25202bccf1ac970bb519312c20
SHA1

d60271d33fbcf94c9c746cd43213896f9788bc66
SHA256

65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06
SHA512

c6badcb5e59155e34b5796553ac7d926d1dd7d7257722dbc52975bea48b5827d3cce810d7efdbbedae76b7fb20946b76ca80e7c503cae7dbcb8182151d7c6905
SSDEEP

1536:ERsjdf1aM67v32Z9x5nouy8VTnZRsjdf1aM67v32Z9x5nouy8VT:EOaHv3YpoutNZOaHv3YpoutN

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2700	xk.exe
1828	IExplorer.exe
1120	WINLOGON.EXE
2960	CSRSS.EXE
2936	SERVICES.EXE
1916	LSASS.EXE
348	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
File created	C:\Windows\SysWOW64\shell.exe	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
File created	C:\Windows\SysWOW64\Mig2.scr	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2124-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00060000000186dd-8.dat	upx
behavioral1/files/0x000600000001932d-109.dat	upx
behavioral1/files/0x000500000001960c-116.dat	upx
behavioral1/memory/2124-120-0x0000000000720000-0x000000000074F000-memory.dmp	upx
behavioral1/memory/1120-136-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2960-145-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2124-144-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000019667-143.dat	upx
behavioral1/files/0x00050000000196a1-156.dat	upx
behavioral1/memory/1916-172-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000019c34-173.dat	upx
behavioral1/memory/348-185-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2124-186-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0005000000019926-167.dat	upx
behavioral1/memory/2936-162-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2960-151-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000500000001961e-131.dat	upx
behavioral1/memory/1828-124-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2700-113-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
File created	C:\Windows\xk.exe	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
2700	xk.exe
1828	IExplorer.exe
1120	WINLOGON.EXE
2960	CSRSS.EXE
2936	SERVICES.EXE
1916	LSASS.EXE
348	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2700	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	30
PID 2124 wrote to memory of 2700	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	30
PID 2124 wrote to memory of 2700	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	30
PID 2124 wrote to memory of 2700	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	30
PID 2124 wrote to memory of 1828	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	31
PID 2124 wrote to memory of 1828	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	31
PID 2124 wrote to memory of 1828	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	31
PID 2124 wrote to memory of 1828	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	31
PID 2124 wrote to memory of 1120	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	32
PID 2124 wrote to memory of 1120	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	32
PID 2124 wrote to memory of 1120	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	32
PID 2124 wrote to memory of 1120	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	32
PID 2124 wrote to memory of 2960	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	33
PID 2124 wrote to memory of 2960	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	33
PID 2124 wrote to memory of 2960	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	33
PID 2124 wrote to memory of 2960	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	33
PID 2124 wrote to memory of 2936	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	34
PID 2124 wrote to memory of 2936	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	34
PID 2124 wrote to memory of 2936	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	34
PID 2124 wrote to memory of 2936	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	34
PID 2124 wrote to memory of 1916	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	35
PID 2124 wrote to memory of 1916	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	35
PID 2124 wrote to memory of 1916	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	35
PID 2124 wrote to memory of 1916	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	35
PID 2124 wrote to memory of 348	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	36
PID 2124 wrote to memory of 348	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	36
PID 2124 wrote to memory of 348	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	36
PID 2124 wrote to memory of 348	2124	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe

C:\Users\Admin\AppData\Local\Temp\65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe
"C:\Users\Admin\AppData\Local\Temp\65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2124
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2700
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1828
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1120
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2960
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2936
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1916
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
90KB

MD5
e9d9ee404e73552110a4672424576102

SHA1
f5dd9b5793eb2f48a444b0d6967c2b4e6ef63a97

SHA256
9018138de48cad50ca62036d513756b5b373f1f0cace4df6a53a3e166854c4b1

SHA512
5a9648f4febbc0a009a93a53349ea1beffb45a7b19fc67c1888fd00469b30a61e04c6e826627420658b0252a1cee6fe4986f6d273bdc3304577e46731734afbd

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
90KB

MD5
43187a62129803102bbc11bdad755766

SHA1
ba3c5fadec3729200392facaf893b34eb86c5cde

SHA256
360146b83606505d1725aa8f55399e3c376224257b37bd4bcb15ab46d29b7300

SHA512
afc6851e6d98cd1939569739cb39464b23b679367ddc5fd1fa0f57cdbae76af712b7643495db611dba957181ed04e1b8a369cc022fcad7d0cdeec4af940794b8

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
90KB

MD5
e1c329a4631fa9e9dbf7e6031f931fcc

SHA1
bc68be74ab65ac4f0b1eaf551e21015866e736c3

SHA256
3c45cf11cb7082cdf3163045e12d4e481f96c6025115261ba193f5d418b0c5b9

SHA512
9673a1d71b6a3bf4517590a45799b600a49b2fc146ec3d21f4487e3d2b7e2d1b1a9a546ffa16faf4813152149e6572a384499e04b9a58c7b7a6b73ff87f9fc90

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
90KB

MD5
2fedb0b2a8f47b1c333e649b97243671

SHA1
7d1889fc3cac330ee48dcf9e51096acacd2de631

SHA256
20ffa4173bfe069bb38aa8e88324c8268cd9e095637307333ba785755ed88d1d

SHA512
b500897ed765717a97902c070bf6aa199e27c37773ec8eaa76d5ca24f5884fd0ee3d9e7e95303cbce36c2c27f8c46ccb66ba3741674329c3a72bb7659865bf85

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
90KB

MD5
53f6ae25202bccf1ac970bb519312c20

SHA1
d60271d33fbcf94c9c746cd43213896f9788bc66

SHA256
65ea978652eda724fa0110a363d7ddd0e83bf2a44693e0b75d252725b9abbe06

SHA512
c6badcb5e59155e34b5796553ac7d926d1dd7d7257722dbc52975bea48b5827d3cce810d7efdbbedae76b7fb20946b76ca80e7c503cae7dbcb8182151d7c6905

Download Submit
C:\Windows\xk.exe

Filesize
90KB

MD5
bf3492d0bf7514fb5b9c5546721e5d1c

SHA1
d982eaf192729ea0590e16db92b6768c8f609fb7

SHA256
1b95b03f84fa8c8334226fe5364c31ced70d50f8b56cf0850bb6cef673bec8d0

SHA512
8cfc006c26e2b87292c5e0a279431444f79e3a4ad4fc293f0203d0ac3703e5ad75e7c1ad13f7f8b1de79b36e82b3d5c95d7a2d01a5de6dd7fc8f746e6ad8324b

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
90KB

MD5
c85b6341330913edbe85ee5d7fb7ed57

SHA1
0f1f08d7349c97bec743cc43f43a945dde387d2e

SHA256
a52004d1605bccd0a1a03c31737994b5e48911fd1192c03e0fb44645a8e1506f

SHA512
84b9ee6a8c26725d038f4b0239140da91a0881ac5fe852525c1e7ee023c102f5d940c766671f0496dff53dbb91e585bb5e2d47461a31ad5317e3a59543e7eb99

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
90KB

MD5
c7b0b8fe8df5c5af0d4e474740e06b7d

SHA1
e657171e017cea500595ddc56e397a3513ade325

SHA256
69d7280e8bf7eeaafa5d6ee17c38f0d5aebb8e70755540a4ac3c855d753593be

SHA512
7931e07193c5923c440d3b0bf12ff08051e48d13cb7329ee3a653077694f74c7c31386376c8402f0d0326655245d0c24f1bd59ca1b74d5a24cea51295969199d

Download Submit
memory/348-185-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1120-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1828-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1916-172-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2124-169-0x0000000000720000-0x000000000074F000-memory.dmp

Filesize
188KB

Download
memory/2124-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2124-180-0x0000000000720000-0x000000000074F000-memory.dmp

Filesize
188KB

Download
memory/2124-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2124-186-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2124-168-0x0000000000720000-0x000000000074F000-memory.dmp

Filesize
188KB

Download
memory/2124-132-0x0000000000720000-0x000000000074F000-memory.dmp

Filesize
188KB

Download
memory/2124-120-0x0000000000720000-0x000000000074F000-memory.dmp

Filesize
188KB

Download
memory/2124-110-0x0000000000720000-0x000000000074F000-memory.dmp

Filesize
188KB

Download
memory/2700-113-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2936-162-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-145-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download