Analysis
-
max time kernel
140s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
death.exe
Resource
win10v2004-20240802-en
General
-
Target
death.exe
-
Size
2.5MB
-
MD5
a39281364d707dd0921b0a36f4a25a4c
-
SHA1
9e4bc8604667e6295900cc8c2813032206435c6f
-
SHA256
85193644036aadb03b1573f25145fa89f13ee5b2399133a9424adb7609163b56
-
SHA512
ee85be6af2692823391c66e957ccb1d187b1e20e94ee3662660a98dbdc1c48ac29dfa6890f80664850622994e8eaf14858e3cb31124b069990cd4fdfa22626dd
-
SSDEEP
49152:pyqJLwC7u1n7I+uiSerQTEsEdUDxqu4B4sbD3I:RIZWerYD4Bx3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe -
Modifies security service 2 TTPs 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security death.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters death.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security death.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters death.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 death.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 death.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo death.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" death.exe Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" death.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsettings.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsettings.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe death.exe -
Executes dropped EXE 17 IoCs
pid Process 1408 mbr.exe 2108 nt.exe 3112 death.exe 4960 mbr.exe 1456 nt.exe 424 death.exe 1248 mbr.exe 4652 nt.exe 3284 death.exe 1592 mbr.exe 1200 nt.exe 4520 death.exe 1688 mbr.exe 540 nt.exe 4296 death.exe 232 mbr.exe 2684 nt.exe -
Modifies system executable filetype association 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 12 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" death.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" death.exe -
resource yara_rule behavioral1/files/0x00080000000234dc-4.dat upx behavioral1/memory/1408-6-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1408-9-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x00070000000234e3-12.dat upx behavioral1/memory/2108-13-0x00000000001D0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2108-16-0x00000000001D0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/4960-25-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1456-29-0x0000000000CB0000-0x0000000000CCA000-memory.dmp upx behavioral1/memory/1248-39-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/4652-44-0x0000000000810000-0x000000000082A000-memory.dmp upx behavioral1/memory/1592-55-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1200-60-0x0000000000300000-0x000000000031A000-memory.dmp upx behavioral1/memory/1688-75-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/540-78-0x0000000000AD0000-0x0000000000AEA000-memory.dmp upx behavioral1/memory/232-90-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2684-95-0x0000000000DC0000-0x0000000000DDA000-memory.dmp upx behavioral1/memory/2684-97-0x0000000000DC0000-0x0000000000DDA000-memory.dmp upx -
Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\666.bmp death.exe File created C:\Windows\mbr.exe death.exe File created C:\Windows\mbr.exe death.exe File created C:\Windows\mbr.exe death.exe File created C:\Windows\nt.exe death.exe File created C:\Windows\mbr.exe death.exe File created C:\Windows\666.bmp death.exe File created C:\Windows\666.bmp death.exe File created C:\Windows\mbr.exe death.exe File created C:\Windows\666.bmp death.exe File created C:\Windows\nt.exe death.exe File created C:\Windows\mbr.exe death.exe File created C:\Windows\nt.exe death.exe File created C:\Windows\666.bmp death.exe File created C:\Windows\nt.exe death.exe File created C:\Windows\666.bmp death.exe File created C:\Windows\nt.exe death.exe File created C:\Windows\nt.exe death.exe -
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language death.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language death.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language death.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language death.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language death.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language death.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop death.exe Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop death.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft death.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run mbr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft death.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System death.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" death.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon death.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon death.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" death.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System\DisableCMD = "2" death.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System death.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Desktop death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies death.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run mbr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" death.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System\DisableCMD = "2" death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Desktop death.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" death.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System\DisableCMD = "2" death.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System\DisableCMD = "2" death.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1" death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System death.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Desktop death.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run mbr.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\death.exe" death.exe -
NTFS ADS 6 IoCs
description ioc Process File opened for modification C:\.C: death.exe File opened for modification C:\.C: death.exe File opened for modification C:\.C: death.exe File opened for modification C:\.C: death.exe File opened for modification C:\.C: death.exe File opened for modification C:\.C: death.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4412 schtasks.exe 3776 schtasks.exe 3964 schtasks.exe 2584 schtasks.exe 2900 schtasks.exe 552 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3612 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe 3112 death.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeCreateGlobalPrivilege 4852 dwm.exe Token: SeChangeNotifyPrivilege 4852 dwm.exe Token: 33 4852 dwm.exe Token: SeIncBasePriorityPrivilege 4852 dwm.exe Token: SeCreateGlobalPrivilege 1720 dwm.exe Token: SeChangeNotifyPrivilege 1720 dwm.exe Token: 33 1720 dwm.exe Token: SeIncBasePriorityPrivilege 1720 dwm.exe Token: SeShutdownPrivilege 1720 dwm.exe Token: SeCreatePagefilePrivilege 1720 dwm.exe Token: SeShutdownPrivilege 1720 dwm.exe Token: SeCreatePagefilePrivilege 1720 dwm.exe Token: SeDebugPrivilege 3612 death.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3612 death.exe 3612 death.exe 3112 death.exe 424 death.exe 3284 death.exe 4520 death.exe 4296 death.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 3612 wrote to memory of 1408 3612 death.exe 82 PID 3612 wrote to memory of 1408 3612 death.exe 82 PID 3612 wrote to memory of 1408 3612 death.exe 82 PID 1408 wrote to memory of 2584 1408 mbr.exe 83 PID 1408 wrote to memory of 2584 1408 mbr.exe 83 PID 1408 wrote to memory of 2584 1408 mbr.exe 83 PID 3612 wrote to memory of 2108 3612 death.exe 86 PID 3612 wrote to memory of 2108 3612 death.exe 86 PID 3612 wrote to memory of 2108 3612 death.exe 86 PID 3112 wrote to memory of 4960 3112 death.exe 88 PID 3112 wrote to memory of 4960 3112 death.exe 88 PID 3112 wrote to memory of 4960 3112 death.exe 88 PID 4960 wrote to memory of 2900 4960 mbr.exe 89 PID 4960 wrote to memory of 2900 4960 mbr.exe 89 PID 4960 wrote to memory of 2900 4960 mbr.exe 89 PID 3112 wrote to memory of 1456 3112 death.exe 92 PID 3112 wrote to memory of 1456 3112 death.exe 92 PID 3112 wrote to memory of 1456 3112 death.exe 92 PID 424 wrote to memory of 1248 424 death.exe 96 PID 424 wrote to memory of 1248 424 death.exe 96 PID 424 wrote to memory of 1248 424 death.exe 96 PID 1248 wrote to memory of 552 1248 mbr.exe 97 PID 1248 wrote to memory of 552 1248 mbr.exe 97 PID 1248 wrote to memory of 552 1248 mbr.exe 97 PID 424 wrote to memory of 4652 424 death.exe 99 PID 424 wrote to memory of 4652 424 death.exe 99 PID 424 wrote to memory of 4652 424 death.exe 99 PID 3284 wrote to memory of 1592 3284 death.exe 104 PID 3284 wrote to memory of 1592 3284 death.exe 104 PID 3284 wrote to memory of 1592 3284 death.exe 104 PID 1592 wrote to memory of 4412 1592 mbr.exe 105 PID 1592 wrote to memory of 4412 1592 mbr.exe 105 PID 1592 wrote to memory of 4412 1592 mbr.exe 105 PID 3284 wrote to memory of 1200 3284 death.exe 107 PID 3284 wrote to memory of 1200 3284 death.exe 107 PID 3284 wrote to memory of 1200 3284 death.exe 107 PID 4520 wrote to memory of 1688 4520 death.exe 109 PID 4520 wrote to memory of 1688 4520 death.exe 109 PID 4520 wrote to memory of 1688 4520 death.exe 109 PID 1688 wrote to memory of 3776 1688 mbr.exe 110 PID 1688 wrote to memory of 3776 1688 mbr.exe 110 PID 1688 wrote to memory of 3776 1688 mbr.exe 110 PID 4520 wrote to memory of 540 4520 death.exe 112 PID 4520 wrote to memory of 540 4520 death.exe 112 PID 4520 wrote to memory of 540 4520 death.exe 112 PID 4296 wrote to memory of 232 4296 death.exe 114 PID 4296 wrote to memory of 232 4296 death.exe 114 PID 4296 wrote to memory of 232 4296 death.exe 114 PID 232 wrote to memory of 3964 232 mbr.exe 115 PID 232 wrote to memory of 3964 232 mbr.exe 115 PID 232 wrote to memory of 3964 232 mbr.exe 115 PID 4296 wrote to memory of 2684 4296 death.exe 117 PID 4296 wrote to memory of 2684 4296 death.exe 117 PID 4296 wrote to memory of 2684 4296 death.exe 117 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" death.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" death.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" death.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer death.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" death.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\death.exe"C:\Users\Admin\AppData\Local\Temp\death.exe"1⤵
- Modifies WinLogon for persistence
- Modifies security service
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Modifies system executable filetype association
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3612 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2584
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:2108
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Users\Admin\AppData\Local\Temp\death.exeC:\Users\Admin\AppData\Local\Temp\death.exe explorer.exe1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3112 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2900
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1456
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
C:\Users\Admin\AppData\Local\Temp\death.exeC:\Users\Admin\AppData\Local\Temp\death.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:424 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:552
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4652
-
-
C:\Users\Admin\AppData\Local\Temp\death.exeC:\Users\Admin\AppData\Local\Temp\death.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3284 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4412
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1200
-
-
C:\Users\Admin\AppData\Local\Temp\death.exeC:\Users\Admin\AppData\Local\Temp\death.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4520 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3776
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:540
-
-
C:\Users\Admin\AppData\Local\Temp\death.exeC:\Users\Admin\AppData\Local\Temp\death.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4296 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3964
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\death.exeC:\Users\Admin\AppData\Local\Temp\death.exe C:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:4404
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5a39281364d707dd0921b0a36f4a25a4c
SHA19e4bc8604667e6295900cc8c2813032206435c6f
SHA25685193644036aadb03b1573f25145fa89f13ee5b2399133a9424adb7609163b56
SHA512ee85be6af2692823391c66e957ccb1d187b1e20e94ee3662660a98dbdc1c48ac29dfa6890f80664850622994e8eaf14858e3cb31124b069990cd4fdfa22626dd
-
Filesize
370KB
MD595b1a43e40e5080a626372c916bc04aa
SHA1b969b8cc0580abe72547e4b70e6f25f24494fa46
SHA256432b44507d1665f903a65d3b04ef0e0c45ce9c03d1bf6b46d556e01c06138aa2
SHA51293c91951fa4f5554d40871519903435ec50c415c8ae6e808c30f5ad09912d51659680ba500d2abba1de05bd646616cf57305f3f54f64a0dcd64a14348f5f23ea
-
Filesize
60KB
MD5e134054e9b86ca5fd7f6102874fa2b1b
SHA18c31adb4c04754463dfa72f9fda21c86584b68d6
SHA256ac6b7a459ab2ae4b618ffb392746ef5ecafcc2d74ad0538698d598ddeb6229c4
SHA512cfc63ef3c57a912b02d1bbdbcaae0dfc917e0ceb30e91868313769fb1be1722d68cd9afc84f399df149c01193a984c1a09d360aaa78d8b9d3fac780ae5b28845
-
Filesize
35KB
MD5462fcc409a04c19841d97845878a2103
SHA1ea46e199131e6275cc9636d624c1edad25b16303
SHA256985e9ffaed5dfcfd00b33e5c2af3cb7284475172f8b7bfbd4393a94a31fcb96b
SHA512d222770d23c20865f9929284687967a6ad9cbc4b92de8d7ee053dc432e808ba7d9e50669184076407a4e0f6a4269a2bee3fad6cab3126c3744977d3e52fc3a0f