fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977d

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Size

45KB
MD5

a8d8f49b36d5e4fab1ffe9da8937adf0
SHA1

d6591d24a1d52ef7578ae94fdbe961c1ac5edbde
SHA256

fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977d
SHA512

618dbf518405c270df3eeebaa6ca477da069afba9929405d02fdcfa026f96131a5cdf5c237df9ebf99a8dfb1dbd6aa39960c6a2ce3663043420d1b3d9478c343
SSDEEP

768:/mFQj8rM9whcqet8Wfb4JzRJwEIHU5U3rf12WmULgJs7DFK+5nEo:1AwEmBT4JzRJwEeUW7f12xULgJzo

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
3068	xk.exe
528	IExplorer.exe
484	WINLOGON.EXE
1644	CSRSS.EXE
2448	SERVICES.EXE
1824	LSASS.EXE
1932	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IExplorer.exe	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
File created	C:\Windows\SysWOW64\shell.exe	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
File created	C:\Windows\SysWOW64\Mig2.scr	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
File created	C:\Windows\xk.exe	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
3068	xk.exe
528	IExplorer.exe
484	WINLOGON.EXE
1644	CSRSS.EXE
2448	SERVICES.EXE
1824	LSASS.EXE
1932	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3068	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	30
PID 2068 wrote to memory of 3068	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	30
PID 2068 wrote to memory of 3068	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	30
PID 2068 wrote to memory of 3068	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	30
PID 2068 wrote to memory of 528	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	31
PID 2068 wrote to memory of 528	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	31
PID 2068 wrote to memory of 528	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	31
PID 2068 wrote to memory of 528	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	31
PID 2068 wrote to memory of 484	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	32
PID 2068 wrote to memory of 484	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	32
PID 2068 wrote to memory of 484	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	32
PID 2068 wrote to memory of 484	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	32
PID 2068 wrote to memory of 1644	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	33
PID 2068 wrote to memory of 1644	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	33
PID 2068 wrote to memory of 1644	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	33
PID 2068 wrote to memory of 1644	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	33
PID 2068 wrote to memory of 2448	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	34
PID 2068 wrote to memory of 2448	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	34
PID 2068 wrote to memory of 2448	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	34
PID 2068 wrote to memory of 2448	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	34
PID 2068 wrote to memory of 1824	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	35
PID 2068 wrote to memory of 1824	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	35
PID 2068 wrote to memory of 1824	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	35
PID 2068 wrote to memory of 1824	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	35
PID 2068 wrote to memory of 1932	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	36
PID 2068 wrote to memory of 1932	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	36
PID 2068 wrote to memory of 1932	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	36
PID 2068 wrote to memory of 1932	2068	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe

C:\Users\Admin\AppData\Local\Temp\fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe
"C:\Users\Admin\AppData\Local\Temp\fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977dN.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2068
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3068
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:528
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:484
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1644
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2448
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1824
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
45KB

MD5
a8d8f49b36d5e4fab1ffe9da8937adf0

SHA1
d6591d24a1d52ef7578ae94fdbe961c1ac5edbde

SHA256
fa1b84ec2305b894b74dd4967df44f50279b4fb47ebef3d0defbe1d2edac977d

SHA512
618dbf518405c270df3eeebaa6ca477da069afba9929405d02fdcfa026f96131a5cdf5c237df9ebf99a8dfb1dbd6aa39960c6a2ce3663043420d1b3d9478c343

Download Submit
C:\Windows\xk.exe

Filesize
45KB

MD5
c5ed0b69f942e13758269db6231f117e

SHA1
41cd676413877fe1234b7cf7348231296385ba76

SHA256
35ad9a6695763eb5a0e55ba20d4cf3ef14351f616348a411fc3c6f8e41b006b9

SHA512
f4ab8437ae720c24dad17a31d36fc561ae3326ef611188cc064519636f35d751e7217cb7b42297af47d379e9e91bd302d2480464837968db807ef0b45b63fb2a

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
45KB

MD5
d6d36c9b83ba27436eb65cec8cae531b

SHA1
2e8238d2d1591d961db47721770cd13d2c331d6f

SHA256
1e9c1507191b392ec3a8d9c98bc9fa81be0dfb8737c6c6f8bae0c609ed11087f

SHA512
edfc9e8e71f4484c0195d5d89e0709ef9f68deeac78bc7d4a1faa2d771f1e24aab8bb50c617cea5d52111edd4ba164e42cde82df6f0681cefdc8bbd97f3ef527

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
45KB

MD5
5e5339017f2dcf3110b17b56acc6f1ce

SHA1
4f576a2125c4c37b04b56706eed538a9895666a7

SHA256
e9ce95826e4c2a8d3dab6d827c9ec5c26d1ad65ccae761cdc7fede59eb1bb539

SHA512
61787f0109b08496157184cbd855512a4d0d03760d62a5562678f5894598cafcfea30c2d8c8dfb077067d45ffeec41e6149274fc6e0fba7428e40847ede81601

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
45KB

MD5
f276e8448ee8e95bc4933e7351bb21bd

SHA1
9ee0722295f089c5febc3ecb9b331fd7d9167289

SHA256
16401a92d99b0139b0bed1708bda3ad2e1cf7603f6257b196a83b65a392a2344

SHA512
1266ec1dec5ebb7c7b02865d094fda97376b8ba9c566fecca77b24c1951e0b24a1de3fdae8ca21af7b4a6c222d17ee5ae68575def15533a49ab098c229111173

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
45KB

MD5
bff7f15e1133345ed617c4658742db63

SHA1
e626cf871399fad7801608ce9af3bb3162d295c4

SHA256
1613ffc5637640d9d7392f793516dfa0c488701993b642e5648114e7cdfe729f

SHA512
04bb22b82f4b35a2adf41b98eb45f3e8150e46eba09d8921179fc0251e02f099ae6d943cab16be85af3088eb5d75e09168fdc232222ff2b01146210be2c49857

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
45KB

MD5
05c1d51b277754eb72c48620bf6a0458

SHA1
a7f51478ee1122ca41b15cc429ffc3b422ac20ef

SHA256
2cd605a657432208ce7099322864d7cb80d36c1fa97e1f56ac0d43c9fe6c8682

SHA512
5e3f3b3b86cb4c5b72e36c4f6203c51b6189dddc5f4efa3147a6d1190ec3ebadbd25831ed83adb46081813bf04e5263258e98f256b6ff7f152a6613201203234

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
45KB

MD5
314153720b85e201c8208fcfd0309a86

SHA1
c6407c807d97c2d0086fb78140a99b72b9ea5f4f

SHA256
ce4ac28cd55fe7eca5c8a3cfff84047e24c8e3d99740b7e59cc7d67f65dd7713

SHA512
1cbd43b7797117e2a540048a96da1196639b5e5be137ee0f4c9ec7140784b79a82e16ce93619ad879cbd673f7644c0e8d25cb083ec26b7fa501b0ce53ee1ff7c

Download Submit
memory/484-141-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/528-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/528-129-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1644-155-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1644-150-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1824-178-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1824-174-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1932-190-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2068-151-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2068-149-0x0000000000550000-0x000000000057E000-memory.dmp

Filesize
184KB

Download
memory/2068-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2068-110-0x0000000000550000-0x000000000057E000-memory.dmp

Filesize
184KB

Download
memory/2068-111-0x0000000000550000-0x000000000057E000-memory.dmp

Filesize
184KB

Download
memory/2068-136-0x0000000000550000-0x000000000057E000-memory.dmp

Filesize
184KB

Download
memory/2068-125-0x0000000000550000-0x000000000057E000-memory.dmp

Filesize
184KB

Download
memory/2068-191-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2448-173-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3068-112-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3068-122-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download