Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 04:57
Static task
static1
Behavioral task
behavioral1
Sample
962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe
Resource
win10v2004-20241007-en
General
-
Target
962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe
-
Size
692KB
-
MD5
9f204136a8f8ecb9d4bd46eb5a531db0
-
SHA1
26b06fe7d8b65065090fc529fc80795a32a59a15
-
SHA256
962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437
-
SHA512
3159250cda528bed0f7ce897116c8726bedff840d4ce321459245ac049a5bb0ac1703070048096a2d087af8c0018639785817331ee8989544301353ac11bd9a6
-
SSDEEP
12288:rXgvmzFHi0mo5aH0qMzd5807FJTPJQPDHvd:rXgvOHi0mGaH0qSdPFJ14V
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ahgor.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ahgor.exe -
Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytgctpiwqxaesgqyzje.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "axmkdbwmirwcsiuehtqfd.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytgctpiwqxaesgqyzje.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "xpzsgzparvvwhsze.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpzsgzparvvwhsze.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "xpzsgzparvvwhsze.exe" ahgor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "exicrlcoglmoamuaz.exe" ahgor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "nhtoezrexdfiviryyh.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "ytgctpiwqxaesgqyzje.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "axmkdbwmirwcsiuehtqfd.exe" ahgor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhtoezrexdfiviryyh.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpzsgzparvvwhsze.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "nhtoezrexdfiviryyh.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axmkdbwmirwcsiuehtqfd.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhtoezrexdfiviryyh.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sfkyhvgmyxs = "lhvskhbqltxcrgracnjx.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nxzkqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytgctpiwqxaesgqyzje.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahgor.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahgor.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe -
Executes dropped EXE 2 IoCs
pid Process 3012 ahgor.exe 2148 ahgor.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend ahgor.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc ahgor.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power ahgor.exe -
Loads dropped DLL 4 IoCs
pid Process 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhvskhbqltxcrgracnjx.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpzsgzparvvwhsze.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdjyixjqddzw = "xpzsgzparvvwhsze.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "axmkdbwmirwcsiuehtqfd.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "ytgctpiwqxaesgqyzje.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfneqhvetvtsbk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytgctpiwqxaesgqyzje.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytgctpiwqxaesgqyzje.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhtoezrexdfiviryyh.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\epselxgku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpzsgzparvvwhsze.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfneqhvetvtsbk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhtoezrexdfiviryyh.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "ytgctpiwqxaesgqyzje.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "axmkdbwmirwcsiuehtqfd.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdjyixjqddzw = "nhtoezrexdfiviryyh.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "ytgctpiwqxaesgqyzje.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\odkalbowkligo = "xpzsgzparvvwhsze.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytgctpiwqxaesgqyzje.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfneqhvetvtsbk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exicrlcoglmoamuaz.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\odkalbowkligo = "axmkdbwmirwcsiuehtqfd.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "axmkdbwmirwcsiuehtqfd.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "exicrlcoglmoamuaz.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\epselxgku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axmkdbwmirwcsiuehtqfd.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdjyixjqddzw = "axmkdbwmirwcsiuehtqfd.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exicrlcoglmoamuaz.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "nhtoezrexdfiviryyh.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfneqhvetvtsbk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exicrlcoglmoamuaz.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhvskhbqltxcrgracnjx.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfneqhvetvtsbk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhvskhbqltxcrgracnjx.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\odkalbowkligo = "axmkdbwmirwcsiuehtqfd.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axmkdbwmirwcsiuehtqfd.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "exicrlcoglmoamuaz.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\epselxgku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpzsgzparvvwhsze.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "xpzsgzparvvwhsze.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdjyixjqddzw = "exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfneqhvetvtsbk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpzsgzparvvwhsze.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\epselxgku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhtoezrexdfiviryyh.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "ytgctpiwqxaesgqyzje.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "nhtoezrexdfiviryyh.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdjyixjqddzw = "lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfneqhvetvtsbk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exicrlcoglmoamuaz.exe ." 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfneqhvetvtsbk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytgctpiwqxaesgqyzje.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "nhtoezrexdfiviryyh.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\odkalbowkligo = "lhvskhbqltxcrgracnjx.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "exicrlcoglmoamuaz.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axmkdbwmirwcsiuehtqfd.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpzsgzparvvwhsze.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\epselxgku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhtoezrexdfiviryyh.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "xpzsgzparvvwhsze.exe ." ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epselxgku = "exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axmkdbwmirwcsiuehtqfd.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhtoezrexdfiviryyh.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\epselxgku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdjyixjqddzw = "exicrlcoglmoamuaz.exe" ahgor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sjskxpeoehggqag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhvskhbqltxcrgracnjx.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdjyixjqddzw = "nhtoezrexdfiviryyh.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdjyixjqddzw = "ytgctpiwqxaesgqyzje.exe" ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\odkalbowkligo = "ytgctpiwqxaesgqyzje.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xjnaivfkvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytgctpiwqxaesgqyzje.exe ." ahgor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\odkalbowkligo = "nhtoezrexdfiviryyh.exe ." ahgor.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahgor.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahgor.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ahgor.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ahgor.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 whatismyip.everdot.org 4 www.whatismyip.ca 7 whatismyipaddress.com 9 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\cfaedhiegvgsokcsbtwrvuy.vxm ahgor.exe File opened for modification C:\Windows\SysWOW64\pdjyixjqddzwdknoilzfuetfmzzvszgjke.vbq ahgor.exe File created C:\Windows\SysWOW64\pdjyixjqddzwdknoilzfuetfmzzvszgjke.vbq ahgor.exe File opened for modification C:\Windows\SysWOW64\cfaedhiegvgsokcsbtwrvuy.vxm ahgor.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\pdjyixjqddzwdknoilzfuetfmzzvszgjke.vbq ahgor.exe File opened for modification C:\Program Files (x86)\cfaedhiegvgsokcsbtwrvuy.vxm ahgor.exe File created C:\Program Files (x86)\cfaedhiegvgsokcsbtwrvuy.vxm ahgor.exe File opened for modification C:\Program Files (x86)\pdjyixjqddzwdknoilzfuetfmzzvszgjke.vbq ahgor.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\cfaedhiegvgsokcsbtwrvuy.vxm ahgor.exe File created C:\Windows\cfaedhiegvgsokcsbtwrvuy.vxm ahgor.exe File opened for modification C:\Windows\pdjyixjqddzwdknoilzfuetfmzzvszgjke.vbq ahgor.exe File created C:\Windows\pdjyixjqddzwdknoilzfuetfmzzvszgjke.vbq ahgor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahgor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahgor.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe 3012 ahgor.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3012 ahgor.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2368 wrote to memory of 3012 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 31 PID 2368 wrote to memory of 3012 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 31 PID 2368 wrote to memory of 3012 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 31 PID 2368 wrote to memory of 3012 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 31 PID 2368 wrote to memory of 2148 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 32 PID 2368 wrote to memory of 2148 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 32 PID 2368 wrote to memory of 2148 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 32 PID 2368 wrote to memory of 2148 2368 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 32 -
System policy modification 1 TTPs 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ahgor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahgor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ahgor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ahgor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahgor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe"C:\Users\Admin\AppData\Local\Temp\962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\ahgor.exe"C:\Users\Admin\AppData\Local\Temp\ahgor.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\ahgor.exe"C:\Users\Admin\AppData\Local\Temp\ahgor.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- System policy modification
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5a101f59dc8df558387c5812573242d08
SHA1d96a2704a3a56455c21653bbaf21c2ee7368c223
SHA256de9e271f181bc479f973f02b08ff7090a04dc77ecbb49e09df881c16ea04d116
SHA512331c3c8f773f273588854a797572c9aa8e086147b9053b5b0496827128426ffaa59f5c6216e3c2c97df66f6b8dbd132c278e46832c7c8edde478b5ffbedf399e
-
Filesize
280B
MD5c8ad36c2a9c426876ccbf3bf25ed0a5e
SHA123d1e834926a6f61863c02eea508a477be77886a
SHA2560646865d81b1745e3d87b68ad15d27271eb79049951f71611251943c1e4a2e50
SHA512cdcdf42b0acfcd21a61ff45d47f85f30d96bfaa341013bd18a19fbac671949ece0fe0a01564ad756f34701938e91a6a0889a917917306589372c19b0d696b887
-
Filesize
280B
MD5c6b72a6b2d241bff801c01e30441e334
SHA150e1dc96bec63c1436372d61ae5cd11cf4c389fc
SHA2561f66e861beb6fae228069b4dffe2cf87d85092eb49643abfa06b4e1f5d9037ee
SHA51207199ee879d9ea128766ea3f99e0638522fa0e371ec3214cd0c13a6e0c10fb1293146df2129f020895e29739821886cfc140db72972863657df14e53ecca58c4
-
Filesize
280B
MD5523e0655896f97b87cd6dbbf5a1f473c
SHA13f21d23a353d5ce60589b6ebedbf0615f0808c90
SHA2567ea10530e0ed6b048302e7e7676d3d7a068447a8de921f96f0e290d8146db60b
SHA5123ed6a16f7208f07bf0b6f01be4a5b3f080dac6ca92b342986577819e38567996f28fd46da21a6cf4160ba0f1f8e84cb3b0da402fc8213b721c1ee8e445b11f03
-
Filesize
280B
MD5d0c936f8694a9a4fb587f768d45d00b2
SHA19567724eec5541a5153493b8e5baea1e845227fc
SHA256836e0ecf4ec98bae24aa0adf4921a57e398dba9fe79cf135f50d478af8380f44
SHA512751147eba668e836735adaad0c2f8c8795d0f466c5e1c19dd1f4d278482f2e7ff73ce0ad7818a9461412458d4fcd63036f53c5ee5cee844d1ffcda40021f80a3
-
Filesize
280B
MD5a127b6bb98ca5882f12d63ebca907925
SHA1443fec890c0216c27a7f2cadd3570aba5cdf9c4b
SHA256a78d8e706c1fddb96b611cc7ccd29542e73c767373c96af452573d5765a70274
SHA51222001df82bba6a42fcb45051ea883fbe53ff5a6bf71790497ad518201930e2eff8898f44309993c59a80f692f975022ef1fbb8a130d9797b18b8e8dbcbc525ee
-
Filesize
280B
MD554e18c8d056da40ce706109669410d91
SHA11df4712c17aa4305262440df11d05d3e0b5d9597
SHA25699bb0c81a7b68282d51fc134a7c3e092891793ec7dc90f9a3274e495c8d21899
SHA51216a98ca9033858e04a8c665d285c39618e67d37d511638a47947a649cee838d27ed787c98e632442637668d999f4d881901348281e40bafa425cc3085efec94c
-
Filesize
4KB
MD54f57095f27adcc023d3401c023fedae3
SHA102f460a263f9298b0e6a7ec04e8a72a91292857f
SHA25660fda659ac265a9fa8743fe4aa9fce3edfee70e84f91c33e4228a1bb5157471f
SHA5126cefe0e8236b19f6d3c87be223bb0186e4d0d3d10a8938f4c97b9ee88cdde57fe4b744014d0ac05ebb16e7775a6ec71eea988669f849829bde39c7bb8268a836
-
Filesize
1.2MB
MD56f451a41c9f96a5c513b4954680286f9
SHA106456a5c776552246efaea2153cd408aa9320c0b
SHA256a32541929feeba2e8f57866fde0354d9354b20638f2a128189b55d351db60614
SHA51282a11fa921cc237d825ba7035bc8fa1e9c3325a26a0ad8aa10fccc163496da0c2e4e63b4ae90f1ffa49ba93ebd33a69d27d7b8f74d8382f264ed8bb53cfdfb32