Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
project1.exe
Resource
win10v2004-20240802-en
General
-
Target
project1.exe
-
Size
2.5MB
-
MD5
f3346cec01e6868ec4f593e7169dec18
-
SHA1
6edc85958c45aa4d27bfa604b507fd032656dfd7
-
SHA256
a29451e1b94ab7a4a4de84be214d39d3c6ff3343dc5df041e627d1071b70201c
-
SHA512
a4bef1622a434c19329e9d8a26b93687bb5b5658d97d071817efed856c6156e997970dea29cac81b5d45c48d350b6546ca56c2290b919187cb9094e8632e366f
-
SSDEEP
49152:fyVIxBwpXBdjmo4k1H5QCsqzklVs1HB4sb:XBFfo5QCsPOB
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe -
Modifies security service 2 TTPs 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 project1.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 project1.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo project1.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security project1.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters project1.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security project1.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters project1.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" project1.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" project1.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsettings.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsettings.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsettings.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe project1.exe -
Executes dropped EXE 22 IoCs
pid Process 4008 mbr.exe 3904 mbr.exe 4864 nt.exe 4764 nt.exe 2124 project1.exe 1172 mbr.exe 1176 nt.exe 4776 project1.exe 372 mbr.exe 3784 nt.exe 2916 project1.exe 3684 mbr.exe 4588 nt.exe 3448 project1.exe 4028 mbr.exe 1040 nt.exe 4660 project1.exe 4484 mbr.exe 2240 nt.exe 1512 project1.exe 2260 mbr.exe 3668 nt.exe -
Modifies system executable filetype association 2 TTPs 32 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 16 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 mbr.exe File opened for modification \??\PhysicalDrive0 nt.exe File opened for modification \??\PhysicalDrive0 mbr.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" project1.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" project1.exe -
resource yara_rule behavioral1/files/0x00090000000233d8-3.dat upx behavioral1/memory/4008-4-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/4008-7-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3904-14-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x0009000000023433-17.dat upx behavioral1/memory/4864-21-0x00000000006A0000-0x00000000006BA000-memory.dmp upx behavioral1/memory/4864-18-0x00000000006A0000-0x00000000006BA000-memory.dmp upx behavioral1/memory/4764-25-0x00000000003F0000-0x000000000040A000-memory.dmp upx behavioral1/memory/1172-34-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1176-41-0x0000000000D50000-0x0000000000D6A000-memory.dmp upx behavioral1/memory/1172-36-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/372-51-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3784-56-0x0000000000030000-0x000000000004A000-memory.dmp upx behavioral1/memory/3684-66-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/4588-71-0x0000000000DF0000-0x0000000000E0A000-memory.dmp upx behavioral1/memory/4028-80-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1040-85-0x0000000000250000-0x000000000026A000-memory.dmp upx behavioral1/memory/1040-87-0x0000000000250000-0x000000000026A000-memory.dmp upx behavioral1/memory/4484-95-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2240-100-0x00000000004E0000-0x00000000004FA000-memory.dmp upx behavioral1/memory/2240-102-0x00000000004E0000-0x00000000004FA000-memory.dmp upx behavioral1/memory/2260-111-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3668-116-0x0000000000530000-0x000000000054A000-memory.dmp upx behavioral1/memory/3668-118-0x0000000000530000-0x000000000054A000-memory.dmp upx -
Drops file in Windows directory 24 IoCs
description ioc Process File created C:\Windows\666.bmp project1.exe File created C:\Windows\666.bmp project1.exe File created C:\Windows\nt.exe project1.exe File created C:\Windows\nt.exe project1.exe File created C:\Windows\mbr.exe project1.exe File created C:\Windows\nt.exe project1.exe File created C:\Windows\666.bmp project1.exe File created C:\Windows\mbr.exe project1.exe File created C:\Windows\mbr.exe project1.exe File created C:\Windows\mbr.exe project1.exe File created C:\Windows\nt.exe project1.exe File created C:\Windows\mbr.exe project1.exe File created C:\Windows\nt.exe project1.exe File created C:\Windows\666.bmp project1.exe File created C:\Windows\nt.exe project1.exe File created C:\Windows\666.bmp project1.exe File created C:\Windows\nt.exe project1.exe File created C:\Windows\666.bmp project1.exe File created C:\Windows\666.bmp project1.exe File created C:\Windows\mbr.exe project1.exe File created C:\Windows\666.bmp project1.exe File created C:\Windows\mbr.exe project1.exe File created C:\Windows\nt.exe project1.exe File created C:\Windows\mbr.exe project1.exe -
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop project1.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop project1.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\mbr.exe" mbr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon project1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run mbr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1" project1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" project1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run mbr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Desktop project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run mbr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System\DisableCMD = "2" project1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Desktop project1.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Desktop project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run mbr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" project1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft project1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System project1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp" project1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Windows\System\DisableCMD = "2" project1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe -
Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command project1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\project1.exe" project1.exe -
NTFS ADS 8 IoCs
description ioc Process File opened for modification C:\.C: project1.exe File opened for modification C:\.C: project1.exe File opened for modification C:\.C: project1.exe File opened for modification C:\.C: project1.exe File opened for modification C:\.C: project1.exe File opened for modification C:\.C: project1.exe File opened for modification C:\.C: project1.exe File opened for modification C:\.C: project1.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1712 schtasks.exe 2668 schtasks.exe 4948 schtasks.exe 3600 schtasks.exe 5116 schtasks.exe 4276 schtasks.exe 1712 schtasks.exe 1484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3244 project1.exe 3244 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 1156 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe 3244 project1.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeCreateGlobalPrivilege 4852 dwm.exe Token: SeChangeNotifyPrivilege 4852 dwm.exe Token: 33 4852 dwm.exe Token: SeIncBasePriorityPrivilege 4852 dwm.exe Token: SeCreateGlobalPrivilege 4368 dwm.exe Token: SeChangeNotifyPrivilege 4368 dwm.exe Token: 33 4368 dwm.exe Token: SeIncBasePriorityPrivilege 4368 dwm.exe Token: SeShutdownPrivilege 4368 dwm.exe Token: SeCreatePagefilePrivilege 4368 dwm.exe Token: SeShutdownPrivilege 4368 dwm.exe Token: SeCreatePagefilePrivilege 4368 dwm.exe Token: SeDebugPrivilege 3244 project1.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1156 project1.exe 3244 project1.exe 3244 project1.exe 2124 project1.exe 4776 project1.exe 2916 project1.exe 3448 project1.exe 4660 project1.exe 1512 project1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 4008 3244 project1.exe 82 PID 3244 wrote to memory of 4008 3244 project1.exe 82 PID 3244 wrote to memory of 4008 3244 project1.exe 82 PID 4008 wrote to memory of 1712 4008 mbr.exe 83 PID 4008 wrote to memory of 1712 4008 mbr.exe 83 PID 4008 wrote to memory of 1712 4008 mbr.exe 83 PID 1156 wrote to memory of 3904 1156 project1.exe 86 PID 1156 wrote to memory of 3904 1156 project1.exe 86 PID 1156 wrote to memory of 3904 1156 project1.exe 86 PID 3904 wrote to memory of 2668 3904 mbr.exe 87 PID 3904 wrote to memory of 2668 3904 mbr.exe 87 PID 3904 wrote to memory of 2668 3904 mbr.exe 87 PID 1156 wrote to memory of 4864 1156 project1.exe 89 PID 1156 wrote to memory of 4864 1156 project1.exe 89 PID 1156 wrote to memory of 4864 1156 project1.exe 89 PID 3244 wrote to memory of 4764 3244 project1.exe 91 PID 3244 wrote to memory of 4764 3244 project1.exe 91 PID 3244 wrote to memory of 4764 3244 project1.exe 91 PID 2124 wrote to memory of 1172 2124 project1.exe 93 PID 2124 wrote to memory of 1172 2124 project1.exe 93 PID 2124 wrote to memory of 1172 2124 project1.exe 93 PID 1172 wrote to memory of 4948 1172 mbr.exe 94 PID 1172 wrote to memory of 4948 1172 mbr.exe 94 PID 1172 wrote to memory of 4948 1172 mbr.exe 94 PID 2124 wrote to memory of 1176 2124 project1.exe 97 PID 2124 wrote to memory of 1176 2124 project1.exe 97 PID 2124 wrote to memory of 1176 2124 project1.exe 97 PID 4776 wrote to memory of 372 4776 project1.exe 100 PID 4776 wrote to memory of 372 4776 project1.exe 100 PID 4776 wrote to memory of 372 4776 project1.exe 100 PID 372 wrote to memory of 3600 372 mbr.exe 101 PID 372 wrote to memory of 3600 372 mbr.exe 101 PID 372 wrote to memory of 3600 372 mbr.exe 101 PID 4776 wrote to memory of 3784 4776 project1.exe 104 PID 4776 wrote to memory of 3784 4776 project1.exe 104 PID 4776 wrote to memory of 3784 4776 project1.exe 104 PID 2916 wrote to memory of 3684 2916 project1.exe 108 PID 2916 wrote to memory of 3684 2916 project1.exe 108 PID 2916 wrote to memory of 3684 2916 project1.exe 108 PID 3684 wrote to memory of 5116 3684 mbr.exe 109 PID 3684 wrote to memory of 5116 3684 mbr.exe 109 PID 3684 wrote to memory of 5116 3684 mbr.exe 109 PID 2916 wrote to memory of 4588 2916 project1.exe 111 PID 2916 wrote to memory of 4588 2916 project1.exe 111 PID 2916 wrote to memory of 4588 2916 project1.exe 111 PID 3448 wrote to memory of 4028 3448 project1.exe 114 PID 3448 wrote to memory of 4028 3448 project1.exe 114 PID 3448 wrote to memory of 4028 3448 project1.exe 114 PID 4028 wrote to memory of 4276 4028 mbr.exe 115 PID 4028 wrote to memory of 4276 4028 mbr.exe 115 PID 4028 wrote to memory of 4276 4028 mbr.exe 115 PID 3448 wrote to memory of 1040 3448 project1.exe 117 PID 3448 wrote to memory of 1040 3448 project1.exe 117 PID 3448 wrote to memory of 1040 3448 project1.exe 117 PID 4660 wrote to memory of 4484 4660 project1.exe 119 PID 4660 wrote to memory of 4484 4660 project1.exe 119 PID 4660 wrote to memory of 4484 4660 project1.exe 119 PID 4484 wrote to memory of 1712 4484 mbr.exe 120 PID 4484 wrote to memory of 1712 4484 mbr.exe 120 PID 4484 wrote to memory of 1712 4484 mbr.exe 120 PID 4660 wrote to memory of 2240 4660 project1.exe 122 PID 4660 wrote to memory of 2240 4660 project1.exe 122 PID 4660 wrote to memory of 2240 4660 project1.exe 122 PID 1512 wrote to memory of 2260 1512 project1.exe 124 -
System policy modification 1 TTPs 16 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" project1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" project1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer project1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" project1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" project1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\project1.exe"C:\Users\Admin\AppData\Local\Temp\project1.exe"1⤵
- Modifies WinLogon for persistence
- Modifies security service
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Modifies system executable filetype association
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3244 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1712
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4764
-
-
C:\Users\Admin\AppData\Local\Temp\project1.exeC:\Users\Admin\AppData\Local\Temp\project1.exe C:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1156 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2668
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4864
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Users\Admin\AppData\Local\Temp\project1.exeC:\Users\Admin\AppData\Local\Temp\project1.exe explorer.exe1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2124 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4948
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1176
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
C:\Users\Admin\AppData\Local\Temp\project1.exeC:\Users\Admin\AppData\Local\Temp\project1.exe C:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4776 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3600
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:3784
-
-
C:\Users\Admin\AppData\Local\Temp\project1.exeC:\Users\Admin\AppData\Local\Temp\project1.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2916 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5116
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4588
-
-
C:\Users\Admin\AppData\Local\Temp\project1.exeC:\Users\Admin\AppData\Local\Temp\project1.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3448 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4276
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\project1.exeC:\Users\Admin\AppData\Local\Temp\project1.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4660 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1712
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\project1.exeC:\Users\Admin\AppData\Local\Temp\project1.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1512 -
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2260 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1484
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:3668
-
-
C:\Users\Admin\AppData\Local\Temp\project1.exeC:\Users\Admin\AppData\Local\Temp\project1.exe C:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:3636
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5f3346cec01e6868ec4f593e7169dec18
SHA16edc85958c45aa4d27bfa604b507fd032656dfd7
SHA256a29451e1b94ab7a4a4de84be214d39d3c6ff3343dc5df041e627d1071b70201c
SHA512a4bef1622a434c19329e9d8a26b93687bb5b5658d97d071817efed856c6156e997970dea29cac81b5d45c48d350b6546ca56c2290b919187cb9094e8632e366f
-
Filesize
370KB
MD595b1a43e40e5080a626372c916bc04aa
SHA1b969b8cc0580abe72547e4b70e6f25f24494fa46
SHA256432b44507d1665f903a65d3b04ef0e0c45ce9c03d1bf6b46d556e01c06138aa2
SHA51293c91951fa4f5554d40871519903435ec50c415c8ae6e808c30f5ad09912d51659680ba500d2abba1de05bd646616cf57305f3f54f64a0dcd64a14348f5f23ea
-
Filesize
60KB
MD5e134054e9b86ca5fd7f6102874fa2b1b
SHA18c31adb4c04754463dfa72f9fda21c86584b68d6
SHA256ac6b7a459ab2ae4b618ffb392746ef5ecafcc2d74ad0538698d598ddeb6229c4
SHA512cfc63ef3c57a912b02d1bbdbcaae0dfc917e0ceb30e91868313769fb1be1722d68cd9afc84f399df149c01193a984c1a09d360aaa78d8b9d3fac780ae5b28845
-
Filesize
35KB
MD5462fcc409a04c19841d97845878a2103
SHA1ea46e199131e6275cc9636d624c1edad25b16303
SHA256985e9ffaed5dfcfd00b33e5c2af3cb7284475172f8b7bfbd4393a94a31fcb96b
SHA512d222770d23c20865f9929284687967a6ad9cbc4b92de8d7ee053dc432e808ba7d9e50669184076407a4e0f6a4269a2bee3fad6cab3126c3744977d3e52fc3a0f