Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/11/2024, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe
Resource
win10v2004-20241007-en
General
-
Target
5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe
-
Size
133KB
-
MD5
0356b7bb07355265f73cbb010ae45041
-
SHA1
9223d100e366a21ae395c9a7b64b13ddb236c389
-
SHA256
5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a
-
SHA512
9d5b7177b162135338946ba1bb90d264c646e799c7980f9355973585a73d94010a95b2f8704293d60919639bb142ae7a66205bb1c2927b88b52ff1b4c9a1ea43
-
SSDEEP
1536:qpO1Ek93yAgfSQUVmHNnPJNAa37I1OcLLDF+2fqzQBZ0+7Pyry4xdWrY9omQ:KkAbf7NN3QL9HxEMIHv6Yc
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M13516\\Ja634608bLay.com\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O41414Z\\TuxO41414Z.exe\"" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M13516\\Ja634608bLay.com\"" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O41414Z\\TuxO41414Z.exe\"" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M13516\\Ja634608bLay.com\"" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O41414Z\\TuxO41414Z.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M13516\\Ja634608bLay.com\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O41414Z\\TuxO41414Z.exe\"" winlogon.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" service.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" service.exe -
Disables RegEdit via registry modification 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" service.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" EmangEloh.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" EmangEloh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe -
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd EmangEloh.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd service.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd smss.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd winlogon.exe -
Executes dropped EXE 4 IoCs
pid Process 2464 service.exe 4540 smss.exe 216 EmangEloh.exe 2928 winlogon.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T14Z051 = "C:\\Windows\\sa-533055.exe" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1135055TT4 = "C:\\Windows\\system32\\805165323741l.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T14Z051 = "C:\\Windows\\sa-533055.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1135055TT4 = "C:\\Windows\\system32\\805165323741l.exe" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T14Z051 = "C:\\Windows\\sa-533055.exe" EmangEloh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1135055TT4 = "C:\\Windows\\system32\\805165323741l.exe" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T14Z051 = "C:\\Windows\\sa-533055.exe" service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1135055TT4 = "C:\\Windows\\system32\\805165323741l.exe" smss.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: EmangEloh.exe File opened (read-only) \??\r: EmangEloh.exe File opened (read-only) \??\s: EmangEloh.exe File opened (read-only) \??\v: service.exe File opened (read-only) \??\y: service.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\g: winlogon.exe File opened (read-only) \??\h: winlogon.exe File opened (read-only) \??\y: winlogon.exe File opened (read-only) \??\z: winlogon.exe File opened (read-only) \??\u: service.exe File opened (read-only) \??\l: smss.exe File opened (read-only) \??\p: smss.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\o: winlogon.exe File opened (read-only) \??\r: winlogon.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\z: smss.exe File opened (read-only) \??\o: EmangEloh.exe File opened (read-only) \??\e: winlogon.exe File opened (read-only) \??\i: winlogon.exe File opened (read-only) \??\v: winlogon.exe File opened (read-only) \??\r: service.exe File opened (read-only) \??\w: smss.exe File opened (read-only) \??\h: service.exe File opened (read-only) \??\w: service.exe File opened (read-only) \??\j: smss.exe File opened (read-only) \??\s: service.exe File opened (read-only) \??\o: smss.exe File opened (read-only) \??\j: EmangEloh.exe File opened (read-only) \??\k: EmangEloh.exe File opened (read-only) \??\p: winlogon.exe File opened (read-only) \??\t: winlogon.exe File opened (read-only) \??\k: service.exe File opened (read-only) \??\x: service.exe File opened (read-only) \??\e: EmangEloh.exe File opened (read-only) \??\w: EmangEloh.exe File opened (read-only) \??\u: winlogon.exe File opened (read-only) \??\e: service.exe File opened (read-only) \??\g: service.exe File opened (read-only) \??\N: EmangEloh.exe File opened (read-only) \??\v: EmangEloh.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\m: EmangEloh.exe File opened (read-only) \??\q: winlogon.exe File opened (read-only) \??\p: service.exe File opened (read-only) \??\e: smss.exe File opened (read-only) \??\k: smss.exe File opened (read-only) \??\m: smss.exe File opened (read-only) \??\t: smss.exe File opened (read-only) \??\q: EmangEloh.exe File opened (read-only) \??\y: EmangEloh.exe File opened (read-only) \??\N: winlogon.exe File opened (read-only) \??\w: winlogon.exe File opened (read-only) \??\j: service.exe File opened (read-only) \??\N: service.exe File opened (read-only) \??\o: service.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\s: smss.exe File opened (read-only) \??\t: EmangEloh.exe File opened (read-only) \??\s: winlogon.exe File opened (read-only) \??\x: winlogon.exe File opened (read-only) \??\t: service.exe File opened (read-only) \??\g: smss.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File created C:\Windows\SysWOW64\805165323741l.exe smss.exe File created C:\Windows\SysWOW64\805165323741l.exe EmangEloh.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\RaHasIA .exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Titip Folder Jangan DiHapus .exe service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll EmangEloh.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\Love Song .scr service.exe File opened for modification C:\Windows\SysWOW64\805165323741l.exe service.exe File opened for modification C:\Windows\SysWOW64\805165323741l.exe smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll winlogon.exe File opened for modification C:\Windows\SysWOW64\X38112go\Z805165cie.cmd winlogon.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\Love Song .scr service.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Gallery .scr service.exe File created C:\Windows\SysWOW64\805165323741l.exe 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File opened for modification C:\Windows\SysWOW64\X38112go\Z805165cie.cmd EmangEloh.exe File opened for modification C:\Windows\SysWOW64\805165323741l.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\805165323741l.exe EmangEloh.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\RaHasIA .exe service.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\Windows Vista setup .scr service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Gallery .scr service.exe File opened for modification C:\Windows\SysWOW64\805165323741l.exe 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\Windows Vista setup .scr service.exe File created C:\Windows\SysWOW64\X38112go\Z805165cie.cmd 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File opened for modification C:\Windows\SysWOW64\X38112go\Z805165cie.cmd service.exe File created C:\Windows\SysWOW64\805165323741l.exe service.exe File opened for modification C:\Windows\SysWOW64\X38112go\Z805165cie.cmd smss.exe File created C:\Windows\SysWOW64\805165323741l.exe winlogon.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Norman virus Control 5.18 .exe service.exe -
Drops file in Program Files directory 27 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\Blink 182 .exe service.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\Titip Folder Jangan DiHapus .exe service.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Shared Gadgets\Gallery .scr service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THe Best Ungu .scr service.exe File created \??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Data DosenKu .exe service.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Love Song .scr service.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Download\Data DosenKu .exe service.exe File created \??\c:\Program Files\dotnet\shared\THe Best Ungu .scr service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\RaHasIA .exe service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\THe Best Ungu .scr service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Norman virus Control 5.18 .exe service.exe File created \??\c:\Program Files\Microsoft Office\Updates\Download\RaHasIA .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\Updates\Download\RaHasIA .exe service.exe File created \??\c:\Program Files\Windows Sidebar\Shared Gadgets\Gallery .scr service.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\Titip Folder Jangan DiHapus .exe service.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\THe Best Ungu .scr service.exe File created \??\c:\Program Files (x86)\Google\Update\Download\Data DosenKu .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\THe Best Ungu .scr service.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Love Song .scr service.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\RaHasIA .exe service.exe File opened for modification \??\c:\Program Files\dotnet\shared\THe Best Ungu .scr service.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\Blink 182 .exe service.exe File created \??\c:\Program Files\Common Files\microsoft shared\THe Best Ungu .scr service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Norman virus Control 5.18 .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THe Best Ungu .scr service.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\M13516\smss.exe smss.exe File created C:\Windows\M13516\smss.exe 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File created \??\c:\Windows\InputMethod\SHARED\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\Gallery .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\Data DosenKu .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\Windows Vista setup .scr service.exe File opened for modification \??\c:\Windows\SoftwareDistribution\Download\SharedFileCache\Windows Vista setup .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\Blink 182 .exe service.exe File created C:\Windows\M13516\Ja634608bLay.com smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\Data DosenKu .exe service.exe File opened for modification C:\Windows\M13516\EmangEloh.exe service.exe File created C:\Windows\Ti323741ta.exe smss.exe File opened for modification \??\c:\Windows\Downloaded Program Files\New mp3 BaraT !! .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\Blink 182 .exe service.exe File opened for modification C:\Windows\sa-533055.exe winlogon.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\Gallery .scr service.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File created C:\Windows\sa-533055.exe smss.exe File opened for modification \??\c:\Windows\InputMethod\SHARED\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\RaHasIA .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\Gallery .scr service.exe File opened for modification C:\Windows\M13516\Ja634608bLay.com 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File created \??\c:\Windows\SystemResources\Windows.ShellCommon.SharedResources\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\TutoriaL HAcking .exe service.exe File opened for modification C:\Windows\system\msvbvm60.dll EmangEloh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\Gallery .scr service.exe File created C:\Windows\Ti323741ta.exe service.exe File opened for modification C:\Windows\[TheMoonlight].txt winlogon.exe File opened for modification \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\Data DosenKu .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\Windows Vista setup .scr service.exe File created \??\c:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\THe Best Ungu .scr service.exe File created C:\Windows\sa-533055.exe winlogon.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\Love Song .scr service.exe File opened for modification C:\Windows\sa-533055.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\Blink 182 .exe service.exe File opened for modification C:\Windows\M13516\Ja634608bLay.com service.exe File opened for modification C:\Windows\Ti323741ta.exe winlogon.exe File created \??\c:\Windows\ServiceProfiles\LocalService\Downloads\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\Windows Vista setup .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\THe Best Ungu .scr service.exe File opened for modification C:\Windows\M13516 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File created C:\Windows\system\msvbvm60.dll 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe File created \??\c:\Windows\SoftwareDistribution\Download\RaHasIA .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\Love Song .scr service.exe File opened for modification C:\Windows\M13516\Ja634608bLay.com EmangEloh.exe File opened for modification C:\Windows\[TheMoonlight].txt EmangEloh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EmangEloh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile service.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 2464 service.exe 4540 smss.exe 216 EmangEloh.exe 2928 winlogon.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2464 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 85 PID 1508 wrote to memory of 2464 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 85 PID 1508 wrote to memory of 2464 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 85 PID 1508 wrote to memory of 4540 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 86 PID 1508 wrote to memory of 4540 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 86 PID 1508 wrote to memory of 4540 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 86 PID 1508 wrote to memory of 216 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 87 PID 1508 wrote to memory of 216 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 87 PID 1508 wrote to memory of 216 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 87 PID 1508 wrote to memory of 2928 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 88 PID 1508 wrote to memory of 2928 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 88 PID 1508 wrote to memory of 2928 1508 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe"C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2464
-
-
C:\Windows\M13516\smss.exe"C:\Windows\M13516\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4540
-
-
C:\Windows\M13516\EmangEloh.exe"C:\Windows\M13516\EmangEloh.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:216
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD50356b7bb07355265f73cbb010ae45041
SHA19223d100e366a21ae395c9a7b64b13ddb236c389
SHA2565433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a
SHA5129d5b7177b162135338946ba1bb90d264c646e799c7980f9355973585a73d94010a95b2f8704293d60919639bb142ae7a66205bb1c2927b88b52ff1b4c9a1ea43
-
Filesize
109B
MD568c7836c8ff19e87ca33a7959a2bdff5
SHA1cc5d0205bb71c10bbed22fe47e59b1f6817daab7
SHA256883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec
SHA5123656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a