Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe
-
Size
608KB
-
MD5
11551100b5caf188919b0b123358f1bb
-
SHA1
dd26d0ec4c80274e984ac2553f9f0510f68c22c1
-
SHA256
c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3
-
SHA512
11ad8a53eab762da1766a0b2fd423d338b1e8de0c396b5c6fc10ccdeb5cde6e334598465844c969414ba37f02e01d19215263a9084a4ea0c465e53e91d798de2
-
SSDEEP
12288:NYBX/tQDwmHtOwu/ctCKaCDnEQvPg5I2R3yTx5KEZt5:NY2w+tOwuMCeEOPp83et5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xencqtkmhox.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" iptcgt.exe -
Adds policy Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe" xencqtkmhox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run iptcgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "idvskleypgiyqolxxiez.exe" iptcgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "idvskleypgiyqolxxiez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "kdtoedumbqqeuqlvtc.exe" xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "vpgcttleuklarokvuez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "kdtoedumbqqeuqlvtc.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idvskleypgiyqolxxiez.exe" iptcgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "vpgcttleuklarokvuez.exe" xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "kdtoedumbqqeuqlvtc.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bticrpfwkyxkzuoxu.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bticrpfwkyxkzuoxu.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulzsgdsivigsgatb.exe" xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hlm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\iptcgt = "bticrpfwkyxkzuoxu.exe" iptcgt.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xencqtkmhox.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iptcgt.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iptcgt.exe -
Executes dropped EXE 4 IoCs
pid Process 1440 xencqtkmhox.exe 2840 iptcgt.exe 2344 iptcgt.exe 2972 xencqtkmhox.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend iptcgt.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc iptcgt.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power iptcgt.exe -
Loads dropped DLL 8 IoCs
pid Process 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 1440 xencqtkmhox.exe 1440 xencqtkmhox.exe 1440 xencqtkmhox.exe 1440 xencqtkmhox.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe" xencqtkmhox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idvskleypgiyqolxxiez.exe ." xencqtkmhox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "idvskleypgiyqolxxiez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\otvc = "idvskleypgiyqolxxiez.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "ulzsgdsivigsgatb.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "kdtoedumbqqeuqlvtc.exe ." xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\blselbjsy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtmkdfzumehyrqobcolha.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "bticrpfwkyxkzuoxu.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe ." iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ktzkqfmu = "xtmkdfzumehyrqobcolha.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "idvskleypgiyqolxxiez.exe ." iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe ." xencqtkmhox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\otvc = "kdtoedumbqqeuqlvtc.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "vpgcttleuklarokvuez.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtmkdfzumehyrqobcolha.exe ." iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bticrpfwkyxkzuoxu.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulzsgdsivigsgatb.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ktzkqfmu = "kdtoedumbqqeuqlvtc.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\otvc = "bticrpfwkyxkzuoxu.exe" xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "bticrpfwkyxkzuoxu.exe ." iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "idvskleypgiyqolxxiez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\blselbjsy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\blselbjsy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe ." iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bticrpfwkyxkzuoxu.exe ." iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bticrpfwkyxkzuoxu.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idvskleypgiyqolxxiez.exe" xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "kdtoedumbqqeuqlvtc.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\blselbjsy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\blselbjsy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bticrpfwkyxkzuoxu.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\otvc = "vpgcttleuklarokvuez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe" xencqtkmhox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ktzkqfmu = "vpgcttleuklarokvuez.exe ." xencqtkmhox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\otvc = "xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgcttleuklarokvuez.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\otvc = "bticrpfwkyxkzuoxu.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "ulzsgdsivigsgatb.exe ." iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "xtmkdfzumehyrqobcolha.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xdgor = "vpgcttleuklarokvuez.exe ." xencqtkmhox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "xtmkdfzumehyrqobcolha.exe" xencqtkmhox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "kdtoedumbqqeuqlvtc.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\blselbjsy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdtoedumbqqeuqlvtc.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bticrpfwkyxkzuoxu.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdisxlr = "bticrpfwkyxkzuoxu.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ktzkqfmu = "bticrpfwkyxkzuoxu.exe ." iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ktzkqfmu = "ulzsgdsivigsgatb.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufnaiziszg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idvskleypgiyqolxxiez.exe" iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\otvc = "idvskleypgiyqolxxiez.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idvskleypgiyqolxxiez.exe" iptcgt.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ktzkqfmu = "xtmkdfzumehyrqobcolha.exe ." iptcgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\otvc = "ulzsgdsivigsgatb.exe" xencqtkmhox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\otvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idvskleypgiyqolxxiez.exe" xencqtkmhox.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ktzkqfmu = "ulzsgdsivigsgatb.exe ." iptcgt.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iptcgt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xencqtkmhox.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xencqtkmhox.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iptcgt.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" iptcgt.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyip.everdot.org 3 www.showmyipaddress.com 8 www.whatismyip.ca 10 whatismyipaddress.com -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf iptcgt.exe File created C:\autorun.inf iptcgt.exe File opened for modification F:\autorun.inf iptcgt.exe File created F:\autorun.inf iptcgt.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ulzsgdsivigsgatb.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\idvskleypgiyqolxxiez.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\olfeybwsleiauuthjwurlk.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\ulzsgdsivigsgatb.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\vpgcttleuklarokvuez.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\vpgcttleuklarokvuez.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\olfeybwsleiauuthjwurlk.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\idvskleypgiyqolxxiez.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\zzwyvbzyuqxspsulqghhe.djh iptcgt.exe File opened for modification C:\Windows\SysWOW64\vpgcttleuklarokvuez.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\xtmkdfzumehyrqobcolha.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\kdtoedumbqqeuqlvtc.exe iptcgt.exe File created C:\Windows\SysWOW64\zzwyvbzyuqxspsulqghhe.djh iptcgt.exe File created C:\Windows\SysWOW64\ufnaiziszgyemanpfgsdlygxgqxewcky.nde iptcgt.exe File opened for modification C:\Windows\SysWOW64\bticrpfwkyxkzuoxu.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\bticrpfwkyxkzuoxu.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\kdtoedumbqqeuqlvtc.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\idvskleypgiyqolxxiez.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\ulzsgdsivigsgatb.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\bticrpfwkyxkzuoxu.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\kdtoedumbqqeuqlvtc.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\vpgcttleuklarokvuez.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\idvskleypgiyqolxxiez.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\xtmkdfzumehyrqobcolha.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\kdtoedumbqqeuqlvtc.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\olfeybwsleiauuthjwurlk.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\ulzsgdsivigsgatb.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\ufnaiziszgyemanpfgsdlygxgqxewcky.nde iptcgt.exe File opened for modification C:\Windows\SysWOW64\xtmkdfzumehyrqobcolha.exe xencqtkmhox.exe File opened for modification C:\Windows\SysWOW64\xtmkdfzumehyrqobcolha.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\olfeybwsleiauuthjwurlk.exe iptcgt.exe File opened for modification C:\Windows\SysWOW64\bticrpfwkyxkzuoxu.exe xencqtkmhox.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\zzwyvbzyuqxspsulqghhe.djh iptcgt.exe File created C:\Program Files (x86)\zzwyvbzyuqxspsulqghhe.djh iptcgt.exe File opened for modification C:\Program Files (x86)\ufnaiziszgyemanpfgsdlygxgqxewcky.nde iptcgt.exe File created C:\Program Files (x86)\ufnaiziszgyemanpfgsdlygxgqxewcky.nde iptcgt.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File created C:\Windows\ufnaiziszgyemanpfgsdlygxgqxewcky.nde iptcgt.exe File opened for modification C:\Windows\zzwyvbzyuqxspsulqghhe.djh iptcgt.exe File opened for modification C:\Windows\ulzsgdsivigsgatb.exe xencqtkmhox.exe File opened for modification C:\Windows\kdtoedumbqqeuqlvtc.exe xencqtkmhox.exe File opened for modification C:\Windows\idvskleypgiyqolxxiez.exe xencqtkmhox.exe File opened for modification C:\Windows\kdtoedumbqqeuqlvtc.exe xencqtkmhox.exe File opened for modification C:\Windows\xtmkdfzumehyrqobcolha.exe xencqtkmhox.exe File opened for modification C:\Windows\olfeybwsleiauuthjwurlk.exe iptcgt.exe File created C:\Windows\zzwyvbzyuqxspsulqghhe.djh iptcgt.exe File opened for modification C:\Windows\vpgcttleuklarokvuez.exe xencqtkmhox.exe File opened for modification C:\Windows\bticrpfwkyxkzuoxu.exe xencqtkmhox.exe File opened for modification C:\Windows\kdtoedumbqqeuqlvtc.exe iptcgt.exe File opened for modification C:\Windows\xtmkdfzumehyrqobcolha.exe iptcgt.exe File opened for modification C:\Windows\xtmkdfzumehyrqobcolha.exe iptcgt.exe File opened for modification C:\Windows\idvskleypgiyqolxxiez.exe xencqtkmhox.exe File opened for modification C:\Windows\ulzsgdsivigsgatb.exe iptcgt.exe File opened for modification C:\Windows\idvskleypgiyqolxxiez.exe iptcgt.exe File opened for modification C:\Windows\ufnaiziszgyemanpfgsdlygxgqxewcky.nde iptcgt.exe File opened for modification C:\Windows\bticrpfwkyxkzuoxu.exe iptcgt.exe File opened for modification C:\Windows\kdtoedumbqqeuqlvtc.exe iptcgt.exe File opened for modification C:\Windows\vpgcttleuklarokvuez.exe iptcgt.exe File opened for modification C:\Windows\olfeybwsleiauuthjwurlk.exe iptcgt.exe File opened for modification C:\Windows\bticrpfwkyxkzuoxu.exe xencqtkmhox.exe File opened for modification C:\Windows\xtmkdfzumehyrqobcolha.exe xencqtkmhox.exe File opened for modification C:\Windows\olfeybwsleiauuthjwurlk.exe xencqtkmhox.exe File opened for modification C:\Windows\ulzsgdsivigsgatb.exe xencqtkmhox.exe File opened for modification C:\Windows\vpgcttleuklarokvuez.exe xencqtkmhox.exe File opened for modification C:\Windows\olfeybwsleiauuthjwurlk.exe xencqtkmhox.exe File opened for modification C:\Windows\ulzsgdsivigsgatb.exe iptcgt.exe File opened for modification C:\Windows\bticrpfwkyxkzuoxu.exe iptcgt.exe File opened for modification C:\Windows\vpgcttleuklarokvuez.exe iptcgt.exe File opened for modification C:\Windows\idvskleypgiyqolxxiez.exe iptcgt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xencqtkmhox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iptcgt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe 2840 iptcgt.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 2840 iptcgt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2840 iptcgt.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3016 wrote to memory of 1440 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 31 PID 3016 wrote to memory of 1440 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 31 PID 3016 wrote to memory of 1440 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 31 PID 3016 wrote to memory of 1440 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 31 PID 1440 wrote to memory of 2840 1440 xencqtkmhox.exe 32 PID 1440 wrote to memory of 2840 1440 xencqtkmhox.exe 32 PID 1440 wrote to memory of 2840 1440 xencqtkmhox.exe 32 PID 1440 wrote to memory of 2840 1440 xencqtkmhox.exe 32 PID 1440 wrote to memory of 2344 1440 xencqtkmhox.exe 33 PID 1440 wrote to memory of 2344 1440 xencqtkmhox.exe 33 PID 1440 wrote to memory of 2344 1440 xencqtkmhox.exe 33 PID 1440 wrote to memory of 2344 1440 xencqtkmhox.exe 33 PID 3016 wrote to memory of 2972 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 35 PID 3016 wrote to memory of 2972 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 35 PID 3016 wrote to memory of 2972 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 35 PID 3016 wrote to memory of 2972 3016 c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe 35 -
System policy modification 1 TTPs 38 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xencqtkmhox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xencqtkmhox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xencqtkmhox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iptcgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" iptcgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" iptcgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" iptcgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iptcgt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xencqtkmhox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" iptcgt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe"C:\Users\Admin\AppData\Local\Temp\c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\xencqtkmhox.exe"C:\Users\Admin\AppData\Local\Temp\xencqtkmhox.exe" "c:\users\admin\appdata\local\temp\c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\iptcgt.exe"C:\Users\Admin\AppData\Local\Temp\iptcgt.exe" "-C:\Users\Admin\AppData\Local\Temp\ulzsgdsivigsgatb.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\iptcgt.exe"C:\Users\Admin\AppData\Local\Temp\iptcgt.exe" "-C:\Users\Admin\AppData\Local\Temp\ulzsgdsivigsgatb.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2344
-
-
-
C:\Users\Admin\AppData\Local\Temp\xencqtkmhox.exe"C:\Users\Admin\AppData\Local\Temp\xencqtkmhox.exe" "c:\users\admin\appdata\local\temp\c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5d063b34266706615b7e4c779cac8730b
SHA17126d3ba968e5f87b7804767e5264a264f4df591
SHA256392c31a3111283b004d02b06517ef190d47e7fc6462c60195240667bffaefa68
SHA512e1bdfa69a19f93e3f335ba16036dfa2dfd536b61da1f324a3df3dfd6e0610bfb36e091a0cb79fba66d9c1f8dbb059cb2d3e191143b0eb235a59862c6d5572aee
-
Filesize
704KB
MD59883767ace72245752d33a68710fbbef
SHA1f59825b6e7effaf0a3c89c29dec94503361292a7
SHA256303eee9504e214e450348d45dc4ce7d34afb44f4cbaabc9c95dba179396513fe
SHA512bfc2ca0e8fed95c0deca8b7db9264453dc818895894c5cf516bf35ba27cc28b65bd8edcf0faec3bc3b2bd2f7931ecfbae695870a933b1d588820153bd97a0d69
-
Filesize
4KB
MD55d868e7c6771b0200f499206a5caa858
SHA1c76788d1f69a342d762013b8b1b13ad77692f8a0
SHA256065fe10e74cead51b41b6a32333877d6dce3f061bad31bf6a4d5cd9cd163a4f8
SHA512f00209280a22faac435433046a050164683646aeccd58f7910fc3a25ac3df499cdf188efe92a1c9b29191295aaefcbbd4d2e5ecec1a2b1eb73d4bd63820f3995
-
Filesize
280B
MD5d5bb22d5852e78462d33f592503cb9fb
SHA157458f09d1aae2640669ba13f8cee45113d79e39
SHA256724a15c067f3d0e680e8ce9bcab38b74d176ce62d4d57881567ef0c0747d2539
SHA51209a08f06140eed97ba916eb63b0c7830e404982105e3b06bd4b410a10acf3c881450effc28c9fde879b20ce4222e3d1c753e828e9ebd999f57cd9186baed9fa0
-
Filesize
280B
MD59a7f84e3deec9f7149f33895eadc48ce
SHA148dde9814c8cc284eda1d356b7eb3dcd1e16fc8c
SHA2561467b201ace813e60a87480eee5cb538eac2e3303293fe60463b1c503336146f
SHA5120663c0289bc44bf51f7c7a33b31e7281b809154949c781d33e20463ec5cec6f9bee502a70e4db7a1a6c77762d5b9e590471f0077f86c4bc89760fea619ab6a1f
-
Filesize
280B
MD50a3aa76d8edbff2cf6ef056c1f8383bc
SHA1ee8ab544b656e34aa4604fee5d67727b94cbec96
SHA256b01e10c3457105b222839a0c5c3616e84a16b5b421733d8f95eef2043c3743cb
SHA51299826ed61e4f5ffeca20c8c1937264531ef4978ea4c1d58a83d35e258a83b4da73ba7ba120fc230577ae937d63cf83a36c02b7a995133d424d334386ad5b31b7
-
Filesize
280B
MD5ee9f98bf5efd69e473696ce08d32e55b
SHA19c5db2017eab2bf73a748d897646d0084a16663e
SHA256fa760d93a0caa890ed6cdc78e63c42044a7fed883f3ca6398545a6a181e81f6f
SHA512e6a9e95a903ba5f7b5d2a6a2613032a0145894ee73c4ae7583161ae5d8ddf0e80ae0d30877daebfd8149ba9c3e75f3a8dbbc591248bf139a3fd8bed913e7f918
-
Filesize
280B
MD5c6fedf8bd67f905ebb6316465f0309e9
SHA1011209c4f010ba6abfb20fc47a985d79846ffb51
SHA2563d5787c9395dc1bc633e8744e03efb1d3c4b9d29350ddfbcb30dd3a79037870c
SHA512b78b4914697ce7026e878bfef0d3a75a77f061218f7dbb3c19788e1d666938cb9ecec939b28653e6e1e0022e35634a2fef5f18b6f79aea1bc4e7f625930cc963
-
Filesize
608KB
MD511551100b5caf188919b0b123358f1bb
SHA1dd26d0ec4c80274e984ac2553f9f0510f68c22c1
SHA256c87c614987ce33454bb6469365cb3584335f2a67c9280e16a959783760f97aa3
SHA51211ad8a53eab762da1766a0b2fd423d338b1e8de0c396b5c6fc10ccdeb5cde6e334598465844c969414ba37f02e01d19215263a9084a4ea0c465e53e91d798de2
-
Filesize
320KB
MD5ce36f74e023f26d58dabc6c55b879cce
SHA110da5b20490a65c294859d8c96e5be0ff70cf11d
SHA2565301f423cabb9476b93cb183fd5dfa3f44ae0f8496d4925a6cd7c4a224fdb415
SHA512a8c6aa9839327377ddd6b9df64993cb7aa9590ffa2e83d4b84d5c05a43bd47daa7ed8cea39bf562fe792bbf5071ef7a5ef605745579b78d9557677a039b63be7