Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe
Resource
win10v2004-20241007-en
General
-
Target
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe
-
Size
9.3MB
-
MD5
8acbaebce4aad71c51039fa86b9a3a31
-
SHA1
dfeeddd2de68073b97ef5c9adc474c15738c4df7
-
SHA256
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6
-
SHA512
8c12681fcbec8cd9a4b12eaa8273cafd7f44d4074e8f42928a4eec2d1775cc450b1dfe1f85812d4aba95e022efc18800c7cff680be1ab0c4e693e3e6bca27f0a
-
SSDEEP
6144:SSK/ymZ3ctTWQHf5w5i5iLCK1/KMSVT86JQPDHDdx/Qtqp:3e0TlHf5w5i5iLCK1/RShPJQPDHvd
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
xfooxkq.exexfooxkq.exebe521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe -
Processes:
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exexfooxkq.exexfooxkq.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xfooxkq.exe -
Adds policy Run key to start application 2 TTPs 29 IoCs
Processes:
xfooxkq.exexfooxkq.exebe521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "mfzkecthxrnvaussdv.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "xrmytskzqlirxsrsexb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvsgdeypifepxuvymhnjg.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "zvsgdeypifepxuvymhnjg.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfzkecthxrnvaussdv.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dvoyroergzubfyvue.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "xrmytskzqlirxsrsexb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmytskzqlirxsrsexb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe" xfooxkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "zvsgdeypifepxuvymhnjg.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "mfzkecthxrnvaussdv.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "dvoyroergzubfyvue.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmytskzqlirxsrsexb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "dvoyroergzubfyvue.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfzkecthxrnvaussdv.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "wnfogcrdrjdjmeay.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dvoyroergzubfyvue.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\odtaqkxhtjbfgw = "mfzkecthxrnvaussdv.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rdquhyipyla = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvsgdeypifepxuvymhnjg.exe" xfooxkq.exe -
Disables RegEdit via registry modification 6 IoCs
Processes:
xfooxkq.exexfooxkq.exebe521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xfooxkq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xfooxkq.exe -
Executes dropped EXE 2 IoCs
Processes:
xfooxkq.exexfooxkq.exepid Process 1676 xfooxkq.exe 380 xfooxkq.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
xfooxkq.exedescription ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend xfooxkq.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc xfooxkq.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power xfooxkq.exe -
Loads dropped DLL 4 IoCs
Processes:
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exepid Process 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
xfooxkq.exexfooxkq.exebe521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dvoyroergzubfyvue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "kfbokkdtlhfpwssuhbgb.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dvoyroergzubfyvue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dvoyroergzubfyvue.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "xrmytskzqlirxsrsexb.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "mfzkecthxrnvaussdv.exe ." be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "kfbokkdtlhfpwssuhbgb.exe ." be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dvoyroergzubfyvue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvsgdeypifepxuvymhnjg.exe ." be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "dvoyroergzubfyvue.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "dvoyroergzubfyvue.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhygxsgrevotvmh = "dvoyroergzubfyvue.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "mfzkecthxrnvaussdv.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "dvoyroergzubfyvue.exe ." be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "kfbokkdtlhfpwssuhbgb.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "zvsgdeypifepxuvymhnjg.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhygxsgrevotvmh = "dvoyroergzubfyvue.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "dvoyroergzubfyvue.exe ." be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dvoyroergzubfyvue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dvoyroergzubfyvue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmytskzqlirxsrsexb.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dvoyroergzubfyvue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "zvsgdeypifepxuvymhnjg.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "dvoyroergzubfyvue.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "dvoyroergzubfyvue.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhygxsgrevotvmh = "zvsgdeypifepxuvymhnjg.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "wnfogcrdrjdjmeay.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhygxsgrevotvmh = "kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhygxsgrevotvmh = "wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mfzkecthxrnvaussdv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhygxsgrevotvmh = "mfzkecthxrnvaussdv.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhygxsgrevotvmh = "wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dvoyroergzubfyvue.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "mfzkecthxrnvaussdv.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvsgdeypifepxuvymhnjg.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "xrmytskzqlirxsrsexb.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmytskzqlirxsrsexb.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "kfbokkdtlhfpwssuhbgb.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mfzkecthxrnvaussdv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmytskzqlirxsrsexb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mfzkecthxrnvaussdv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "kfbokkdtlhfpwssuhbgb.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvsgdeypifepxuvymhnjg.exe" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfzkecthxrnvaussdv.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wnfogcrdrjdjmeay = "xrmytskzqlirxsrsexb.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrmytskzqlirxsrsexb.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mfzkecthxrnvaussdv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dvoyroergzubfyvue.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "mfzkecthxrnvaussdv.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mfzkecthxrnvaussdv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfzkecthxrnvaussdv.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfzkecthxrnvaussdv.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "wnfogcrdrjdjmeay.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dvoyroergzubfyvue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfzkecthxrnvaussdv.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\obpuialtdrhj = "xrmytskzqlirxsrsexb.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mfzkecthxrnvaussdv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfbokkdtlhfpwssuhbgb.exe" xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\rhygxsgrevotvmh = "zvsgdeypifepxuvymhnjg.exe" xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "wnfogcrdrjdjmeay.exe ." xfooxkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dvoyroergzubfyvue = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wnfogcrdrjdjmeay.exe ." xfooxkq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbqwleqzkzqtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvsgdeypifepxuvymhnjg.exe ." xfooxkq.exe -
Processes:
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exexfooxkq.exexfooxkq.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xfooxkq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xfooxkq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xfooxkq.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
Processes:
xfooxkq.exebe521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exexfooxkq.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xfooxkq.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 www.whatismyip.ca 4 whatismyip.everdot.org 7 www.showmyipaddress.com 10 whatismyipaddress.com -
Drops file in System32 directory 4 IoCs
Processes:
xfooxkq.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\jnsotcedejqjzenyuxlpuqveg.gls xfooxkq.exe File created C:\Windows\SysWOW64\jnsotcedejqjzenyuxlpuqveg.gls xfooxkq.exe File opened for modification C:\Windows\SysWOW64\odtaqkxhtjbfgwqmthgvlsicpzlbtxyoielz.ndk xfooxkq.exe File created C:\Windows\SysWOW64\odtaqkxhtjbfgwqmthgvlsicpzlbtxyoielz.ndk xfooxkq.exe -
Drops file in Program Files directory 4 IoCs
Processes:
xfooxkq.exedescription ioc Process File opened for modification C:\Program Files (x86)\odtaqkxhtjbfgwqmthgvlsicpzlbtxyoielz.ndk xfooxkq.exe File created C:\Program Files (x86)\odtaqkxhtjbfgwqmthgvlsicpzlbtxyoielz.ndk xfooxkq.exe File opened for modification C:\Program Files (x86)\jnsotcedejqjzenyuxlpuqveg.gls xfooxkq.exe File created C:\Program Files (x86)\jnsotcedejqjzenyuxlpuqveg.gls xfooxkq.exe -
Drops file in Windows directory 4 IoCs
Processes:
xfooxkq.exedescription ioc Process File opened for modification C:\Windows\jnsotcedejqjzenyuxlpuqveg.gls xfooxkq.exe File created C:\Windows\jnsotcedejqjzenyuxlpuqveg.gls xfooxkq.exe File opened for modification C:\Windows\odtaqkxhtjbfgwqmthgvlsicpzlbtxyoielz.ndk xfooxkq.exe File created C:\Windows\odtaqkxhtjbfgwqmthgvlsicpzlbtxyoielz.ndk xfooxkq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exexfooxkq.exexfooxkq.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfooxkq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfooxkq.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xfooxkq.exepid Process 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe 1676 xfooxkq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
xfooxkq.exedescription pid Process Token: SeDebugPrivilege 1676 xfooxkq.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exedescription pid Process procid_target PID 1968 wrote to memory of 1676 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 31 PID 1968 wrote to memory of 1676 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 31 PID 1968 wrote to memory of 1676 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 31 PID 1968 wrote to memory of 1676 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 31 PID 1968 wrote to memory of 380 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 32 PID 1968 wrote to memory of 380 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 32 PID 1968 wrote to memory of 380 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 32 PID 1968 wrote to memory of 380 1968 be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe 32 -
System policy modification 1 TTPs 36 IoCs
Processes:
be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exexfooxkq.exexfooxkq.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xfooxkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xfooxkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xfooxkq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xfooxkq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe"C:\Users\Admin\AppData\Local\Temp\be521f0a005a06837effbec40bb14824a0d6df50f981aa88e23e51f28121cbc6.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\xfooxkq.exe"C:\Users\Admin\AppData\Local\Temp\xfooxkq.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\xfooxkq.exe"C:\Users\Admin\AppData\Local\Temp\xfooxkq.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- System policy modification
PID:380
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD55b2332375cd8464dac503dcde53effa8
SHA1321d9ab6130ea3d263a08a84500085b39a4cbaad
SHA256b16ce95ea55c2d1add6c3055f21db59394e14cd65077564fff82d6efcc87a590
SHA512d30e822dade839b209675985f0f2a80cb5896d41bee54e6cd09fff7cc0aa2cd10b96778e878d9283e17223bcbe4c0e2e1c6dbd334a7af9dc4dc97f6780a5adad
-
Filesize
272B
MD52a1bf6e49f52dc89b0ef04144797813d
SHA18ee38356e90ab4b7ed17775cd78d2288692bd4b4
SHA25630cb9a952965507d7037fe95cf30c4b35772fbf369021ecd2cf4bc23e10175c3
SHA5121284e8d3b885aed5eac9c4a33223350bf928b3dbcae9d03be141a601ebab1824bac6544d30470e94c54a5106a5150e20239a202413b8d2a32d256e13ffd7d532
-
Filesize
272B
MD57a1a34ba183575a6e7ccf4166fff4174
SHA1c285613cc2500fa2f1869980a1d8fa9293bbc778
SHA256ab37a518a4b3995403f57aeb70edc73398de66c303292d88caa3878e92753e4d
SHA512cd70be07ee686f7fcc1941499b5f6f0a84210a14b61846d5c4f12a82afdb92456ad7b1107dd29b92917d873e516acca9ec805bf0e1e24638ad5a4a332c00dea9
-
Filesize
272B
MD59a8c608f11a3ef7bafd176bb24a33d8c
SHA16b092fa7d34a40d770ae7eab2e4c355759710853
SHA256f9b3f4439d9b9637b20f7dd883e2e5bcaafdf3f1a96184ebc012e011436cf6e7
SHA5127e146c6b748e9dc81f1fc6152eb56d24e920a361e96f5079214aeb56a05f26138aa0767b12bb6e545f7badede450a86a00580d13130a4df04453b9de74215d09
-
Filesize
272B
MD596a8f71a254fbd7afb5d2f2f55fe3892
SHA1b479d0fbdb259c88527d0d2c1aab6714cb19b9d0
SHA256fe15b70982d65aa650c294f14a7e8af41b2266da0eebccd74812bb8efb489372
SHA512ffafd965bd6fcd646137d9edb371648107880ebf27c25d5ea8ffab9cb0cea85449e7b34e0d440440a51fc28ef5c51c1d7711c507b756e2ab7366765eb6304b66
-
Filesize
272B
MD566476dec5271649ec1a250303a397dce
SHA1c7653948d3c186de6bd9086c17b65e586ac24537
SHA256077aaa472fe27e094cd77a2a393d127c2b3bf506dc66c385996079928728ed66
SHA51237814be8dee6d32c13b0682fa105dd9152288692488c1989660a876257fcb69cf5a0679aae95ecdee642f63a8d103ec889778e19bf55ae9a0f440861f0d1c947
-
Filesize
11.3MB
MD54e9173379c1a5f2bd310aed24d0173f7
SHA1728dfe6ee560f6bf9f8f3c080bb37147306e0791
SHA256d8945b7d4640adb92889f2bce214380c2ac4c0bf98c1bc497f68f71104c8ac4c
SHA51249f1c09055dc8a1770d5829293f85c1015e35aeec2a316b895b35a51d8dc7bf1595683ab206c72da19e87507f4f06f714ac36f2a845025f0fea368d1acf06054
-
Filesize
272B
MD5bd3fb57702fc72224f6d28f3bc382af7
SHA1d243f474c3ff146975cceaf4c0dcd75b42eba2f2
SHA25637062e3d243495d6bde0cd9a9ef5f7758fe9851e3a8181af907fecdae57d644c
SHA5127ba488d290c90bb566555992561826abcad3b9f5b1201698b0335622dc102689408d85309ba9a3594a4d9f5b2a1f8bf664bb75f6de2b00720befb9e2c7c9a273
-
Filesize
272B
MD59eac7b145307086750cdc0539fbf8729
SHA1cd0b40d6125dbe768b2228c4db9001a6fb253072
SHA25632e15c055b163eab9e1dcad44afd402395987e0961f705404ac17747488f1ddc
SHA51281b11da6827ca41d73bfa838a1d7a7a08c20815c296c140a5ba16f4510086c79aa409b2d92e64fc1c3e01aecd87b3705165e766876fd1aec1232b6213b7ab25a
-
Filesize
272B
MD566783162b5237395e47765d43f099f21
SHA1e401cb433e1d5d37f93a0d401e42512d31154850
SHA2564c94ce74130c9e608240f44886660896e9cfa10397b86cfc65b1b0ec6d0cde07
SHA512197d9c985e29ae4e33843fee45adb248d7c2edb12e0ec029b79af3b7d96d3ec12af693d3c40147391abbe9ac3115e62c9cb815dda419b78813e1befdd78e5ea3
-
Filesize
3KB
MD5963f2af9132c26a21166f4f05af0f3fe
SHA1dcf360ac4d07856151470abede7acd7eb9ceb239
SHA256d4981907b3b03ae2d5b673363d5571ced13d6d6e23fe55d9fe5c34c79bbb2aa6
SHA512f09d9d63cb2c0a62c9c88c39f320aa6d72757d71543e54b647c5b683e5439805904842f23e4e6ac77311b1423f1d9e3428d849bff43d97e97c03d05137e6455d