Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 02:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe
Resource
win7-20241010-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe
-
Size
1016KB
-
MD5
ee47200f60aa0ffe7e554db291da8a8f
-
SHA1
a2ab0c657b6045b98aca1befb1fe2ce02ca0ae9e
-
SHA256
b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7
-
SHA512
02512eaff12cf835116833bead2006aa14e4f86e65f0225887e5d9e2b7a199849222bd15d50bf269e23646192f7cde45f9cb3746964bb6d3e6d325b4d250d478
-
SSDEEP
6144:GIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUM:GIXsgtvm1De5YlOx6lzBH46UM
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cnrfakasmxb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lmxcgo.exe -
Adds policy Run key to start application 2 TTPs 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "eqmcrkbxilcmghxtr.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqqkdavvkrmaydxxztjjd.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "naxoeyqnzdvgbdurqh.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lazskgazntnaxbutuncb.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\naxoeyqnzdvgbdurqh.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqqkdavvkrmaydxxztjjd.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "lazskgazntnaxbutuncb.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "xidsgyojtvlunncx.exe" lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmcrkbxilcmghxtr.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xidsgyojtvlunncx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "aqqkdavvkrmaydxxztjjd.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmcrkbxilcmghxtr.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\naxoeyqnzdvgbdurqh.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "lazskgazntnaxbutuncb.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lazskgazntnaxbutuncb.exe" lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "aqqkdavvkrmaydxxztjjd.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\syoyhufvaxi = "lazskgazntnaxbutuncb.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nqdkqaiv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xidsgyojtvlunncx.exe" cnrfakasmxb.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cnrfakasmxb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lmxcgo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lmxcgo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cnrfakasmxb.exe -
Executes dropped EXE 4 IoCs
pid Process 2132 cnrfakasmxb.exe 2236 lmxcgo.exe 3000 lmxcgo.exe 2436 cnrfakasmxb.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc lmxcgo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power lmxcgo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend lmxcgo.exe -
Loads dropped DLL 8 IoCs
pid Process 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2132 cnrfakasmxb.exe 2132 cnrfakasmxb.exe 2132 cnrfakasmxb.exe 2132 cnrfakasmxb.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "ymkctohfsxqcybtrrjx.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\naxoeyqnzdvgbdurqh.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\naxoeyqnzdvgbdurqh.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmcrkbxilcmghxtr.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xidsgyojtvlunncx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pyreqgunvvjqhf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmcrkbxilcmghxtr.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\pwnyiwizfdpu = "aqqkdavvkrmaydxxztjjd.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xidsgyojtvlunncx.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\pwnyiwizfdpu = "aqqkdavvkrmaydxxztjjd.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lazskgazntnaxbutuncb.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\pwnyiwizfdpu = "naxoeyqnzdvgbdurqh.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "aqqkdavvkrmaydxxztjjd.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lazskgazntnaxbutuncb.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "naxoeyqnzdvgbdurqh.exe ." cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lazskgazntnaxbutuncb.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\naxoeyqnzdvgbdurqh.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "naxoeyqnzdvgbdurqh.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\pwnyiwizfdpu = "ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "xidsgyojtvlunncx.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xidsgyojtvlunncx.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqqkdavvkrmaydxxztjjd.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqqkdavvkrmaydxxztjjd.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "aqqkdavvkrmaydxxztjjd.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "lazskgazntnaxbutuncb.exe ." cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "eqmcrkbxilcmghxtr.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmcrkbxilcmghxtr.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\pwnyiwizfdpu = "lazskgazntnaxbutuncb.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "eqmcrkbxilcmghxtr.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "aqqkdavvkrmaydxxztjjd.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "xidsgyojtvlunncx.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "aqqkdavvkrmaydxxztjjd.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmcrkbxilcmghxtr.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pyreqgunvvjqhf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lazskgazntnaxbutuncb.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\naxoeyqnzdvgbdurqh.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "eqmcrkbxilcmghxtr.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lazskgazntnaxbutuncb.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\pwnyiwizfdpu = "xidsgyojtvlunncx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pyreqgunvvjqhf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqqkdavvkrmaydxxztjjd.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pyreqgunvvjqhf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmcrkbxilcmghxtr.exe ." cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmcrkbxilcmghxtr.exe" lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "naxoeyqnzdvgbdurqh.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\pwnyiwizfdpu = "xidsgyojtvlunncx.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "naxoeyqnzdvgbdurqh.exe ." cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "naxoeyqnzdvgbdurqh.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scwkxodxghwewvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymkctohfsxqcybtrrjx.exe" lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pyreqgunvvjqhf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqqkdavvkrmaydxxztjjd.exe ." cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "ymkctohfsxqcybtrrjx.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pyreqgunvvjqhf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xidsgyojtvlunncx.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "eqmcrkbxilcmghxtr.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owoalanfmlyeu = "lazskgazntnaxbutuncb.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "ymkctohfsxqcybtrrjx.exe" cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "aqqkdavvkrmaydxxztjjd.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pyreqgunvvjqhf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\naxoeyqnzdvgbdurqh.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "lazskgazntnaxbutuncb.exe ." cnrfakasmxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pyreqgunvvjqhf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqqkdavvkrmaydxxztjjd.exe ." lmxcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xcraiuetxt = "xidsgyojtvlunncx.exe ." lmxcgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\eiwelwftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lazskgazntnaxbutuncb.exe" lmxcgo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cnrfakasmxb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lmxcgo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lmxcgo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cnrfakasmxb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cnrfakasmxb.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" lmxcgo.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyip.everdot.org 3 www.showmyipaddress.com 8 whatismyipaddress.com 10 www.whatismyip.ca -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf lmxcgo.exe File created C:\autorun.inf lmxcgo.exe File opened for modification F:\autorun.inf lmxcgo.exe File created F:\autorun.inf lmxcgo.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\lazskgazntnaxbutuncb.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\pyreqgunvvjqhfslgtcviukyrzznuljwpkxg.myo lmxcgo.exe File opened for modification C:\Windows\SysWOW64\xidsgyojtvlunncx.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\naxoeyqnzdvgbdurqh.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\naxoeyqnzdvgbdurqh.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\eqmcrkbxilcmghxtr.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\ymkctohfsxqcybtrrjx.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\aqqkdavvkrmaydxxztjjd.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\aqqkdavvkrmaydxxztjjd.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\lazskgazntnaxbutuncb.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\aqqkdavvkrmaydxxztjjd.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\rijeywstjrncbhcdgbstoi.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\naxoeyqnzdvgbdurqh.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\ymkctohfsxqcybtrrjx.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\rijeywstjrncbhcdgbstoi.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\lazskgazntnaxbutuncb.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\xidsgyojtvlunncx.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\kiqstybjgvyuanpxhjhprsxai.uxt lmxcgo.exe File opened for modification C:\Windows\SysWOW64\ymkctohfsxqcybtrrjx.exe lmxcgo.exe File created C:\Windows\SysWOW64\pyreqgunvvjqhfslgtcviukyrzznuljwpkxg.myo lmxcgo.exe File opened for modification C:\Windows\SysWOW64\aqqkdavvkrmaydxxztjjd.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\rijeywstjrncbhcdgbstoi.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\eqmcrkbxilcmghxtr.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\naxoeyqnzdvgbdurqh.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\xidsgyojtvlunncx.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\eqmcrkbxilcmghxtr.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\ymkctohfsxqcybtrrjx.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\lazskgazntnaxbutuncb.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\rijeywstjrncbhcdgbstoi.exe cnrfakasmxb.exe File opened for modification C:\Windows\SysWOW64\eqmcrkbxilcmghxtr.exe lmxcgo.exe File opened for modification C:\Windows\SysWOW64\xidsgyojtvlunncx.exe cnrfakasmxb.exe File created C:\Windows\SysWOW64\kiqstybjgvyuanpxhjhprsxai.uxt lmxcgo.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\kiqstybjgvyuanpxhjhprsxai.uxt lmxcgo.exe File created C:\Program Files (x86)\kiqstybjgvyuanpxhjhprsxai.uxt lmxcgo.exe File opened for modification C:\Program Files (x86)\pyreqgunvvjqhfslgtcviukyrzznuljwpkxg.myo lmxcgo.exe File created C:\Program Files (x86)\pyreqgunvvjqhfslgtcviukyrzznuljwpkxg.myo lmxcgo.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\lazskgazntnaxbutuncb.exe cnrfakasmxb.exe File opened for modification C:\Windows\rijeywstjrncbhcdgbstoi.exe cnrfakasmxb.exe File opened for modification C:\Windows\pyreqgunvvjqhfslgtcviukyrzznuljwpkxg.myo lmxcgo.exe File opened for modification C:\Windows\rijeywstjrncbhcdgbstoi.exe cnrfakasmxb.exe File opened for modification C:\Windows\ymkctohfsxqcybtrrjx.exe cnrfakasmxb.exe File opened for modification C:\Windows\ymkctohfsxqcybtrrjx.exe lmxcgo.exe File opened for modification C:\Windows\ymkctohfsxqcybtrrjx.exe cnrfakasmxb.exe File opened for modification C:\Windows\xidsgyojtvlunncx.exe cnrfakasmxb.exe File opened for modification C:\Windows\lazskgazntnaxbutuncb.exe lmxcgo.exe File opened for modification C:\Windows\naxoeyqnzdvgbdurqh.exe lmxcgo.exe File opened for modification C:\Windows\rijeywstjrncbhcdgbstoi.exe lmxcgo.exe File opened for modification C:\Windows\eqmcrkbxilcmghxtr.exe cnrfakasmxb.exe File opened for modification C:\Windows\naxoeyqnzdvgbdurqh.exe cnrfakasmxb.exe File opened for modification C:\Windows\aqqkdavvkrmaydxxztjjd.exe lmxcgo.exe File opened for modification C:\Windows\xidsgyojtvlunncx.exe cnrfakasmxb.exe File opened for modification C:\Windows\aqqkdavvkrmaydxxztjjd.exe lmxcgo.exe File opened for modification C:\Windows\naxoeyqnzdvgbdurqh.exe lmxcgo.exe File opened for modification C:\Windows\naxoeyqnzdvgbdurqh.exe cnrfakasmxb.exe File opened for modification C:\Windows\lazskgazntnaxbutuncb.exe cnrfakasmxb.exe File opened for modification C:\Windows\eqmcrkbxilcmghxtr.exe cnrfakasmxb.exe File opened for modification C:\Windows\xidsgyojtvlunncx.exe lmxcgo.exe File opened for modification C:\Windows\rijeywstjrncbhcdgbstoi.exe lmxcgo.exe File opened for modification C:\Windows\eqmcrkbxilcmghxtr.exe lmxcgo.exe File opened for modification C:\Windows\kiqstybjgvyuanpxhjhprsxai.uxt lmxcgo.exe File created C:\Windows\pyreqgunvvjqhfslgtcviukyrzznuljwpkxg.myo lmxcgo.exe File opened for modification C:\Windows\aqqkdavvkrmaydxxztjjd.exe cnrfakasmxb.exe File opened for modification C:\Windows\ymkctohfsxqcybtrrjx.exe lmxcgo.exe File opened for modification C:\Windows\xidsgyojtvlunncx.exe lmxcgo.exe File opened for modification C:\Windows\lazskgazntnaxbutuncb.exe lmxcgo.exe File created C:\Windows\kiqstybjgvyuanpxhjhprsxai.uxt lmxcgo.exe File opened for modification C:\Windows\aqqkdavvkrmaydxxztjjd.exe cnrfakasmxb.exe File opened for modification C:\Windows\eqmcrkbxilcmghxtr.exe lmxcgo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cnrfakasmxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lmxcgo.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 2236 lmxcgo.exe 2236 lmxcgo.exe 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2236 lmxcgo.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2132 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 30 PID 2648 wrote to memory of 2132 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 30 PID 2648 wrote to memory of 2132 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 30 PID 2648 wrote to memory of 2132 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 30 PID 2132 wrote to memory of 2236 2132 cnrfakasmxb.exe 31 PID 2132 wrote to memory of 2236 2132 cnrfakasmxb.exe 31 PID 2132 wrote to memory of 2236 2132 cnrfakasmxb.exe 31 PID 2132 wrote to memory of 2236 2132 cnrfakasmxb.exe 31 PID 2132 wrote to memory of 3000 2132 cnrfakasmxb.exe 32 PID 2132 wrote to memory of 3000 2132 cnrfakasmxb.exe 32 PID 2132 wrote to memory of 3000 2132 cnrfakasmxb.exe 32 PID 2132 wrote to memory of 3000 2132 cnrfakasmxb.exe 32 PID 2648 wrote to memory of 2436 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 34 PID 2648 wrote to memory of 2436 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 34 PID 2648 wrote to memory of 2436 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 34 PID 2648 wrote to memory of 2436 2648 b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe 34 -
System policy modification 1 TTPs 37 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cnrfakasmxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer lmxcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" cnrfakasmxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lmxcgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" lmxcgo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe"C:\Users\Admin\AppData\Local\Temp\b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\cnrfakasmxb.exe"C:\Users\Admin\AppData\Local\Temp\cnrfakasmxb.exe" "c:\users\admin\appdata\local\temp\b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\lmxcgo.exe"C:\Users\Admin\AppData\Local\Temp\lmxcgo.exe" "-C:\Users\Admin\AppData\Local\Temp\xidsgyojtvlunncx.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2236
-
-
C:\Users\Admin\AppData\Local\Temp\lmxcgo.exe"C:\Users\Admin\AppData\Local\Temp\lmxcgo.exe" "-C:\Users\Admin\AppData\Local\Temp\xidsgyojtvlunncx.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:3000
-
-
-
C:\Users\Admin\AppData\Local\Temp\cnrfakasmxb.exe"C:\Users\Admin\AppData\Local\Temp\cnrfakasmxb.exe" "c:\users\admin\appdata\local\temp\b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5d8a580e0c4fcffed6b6b97c782779d57
SHA19bbdbad358814acb8397b85a0889196d06b80e6e
SHA256a940ea30627371c1602fbf3193c0e0a053e6c94892ca7faa1aa1934da857f058
SHA512d5a9f79ec6537543d0d882f5c5666579c602e5d4ee3ca3c0fee199b2750e075c5446e0641f9f26ecb51d099e6fc80691dd7450864c0302be5ca8d6d2065ba2fd
-
Filesize
280B
MD58a336946dad8824d03d4ee871a62d4af
SHA1d1df7c6c7fbf41e7bff0636c3d164221fef32b4f
SHA256cd965d31a2c8b7962177af5797a2437f1d40d629811519e7db8a9c439428370f
SHA512f263cb5214392dcf39bc1e6bc7a37c0e37ae4e0ff36fac1037bc94aea5c56d5556fd9e9f5f0ffb24f1a465113ba2ee35a9840ea0db79fbbbb92de54b1c1c2b3c
-
Filesize
280B
MD5a34709c2932b5b49fe48e8bfc0c6f76f
SHA1e1a33ca70387901127c1e9341b3131afdd20dd56
SHA2564e23331d6e688679e409d44b2feffaaa2269511b78a49db244c5ca0cdfc9c439
SHA5126ef84d8ed066cef16dc5b7246924cb68860d4503e72f1d3b94a8ec55578bebc8186e9dd9f7e940d2770d3371c72a72af060ffa0ca06e6db518dbb391369bd30b
-
Filesize
280B
MD53f1ab9cc381c43aac4b510acf6e387f9
SHA146cf09339f1e5d9b06639d43e1ec97141b21622f
SHA256da1bf4606fed6c78bf8b61b707a0f2308c3266fc58679544a52303bfedeaa6f7
SHA5124ad41f59a7e95f28be872081036886d48970e625819f12eb696ddc8273d62f98a945476ee08b14359353c9908e1a7e41ec495b41a0d4fd1c772dd4e54f9d45b8
-
Filesize
280B
MD5da82fdfec9ce8915d30f8eca2852716c
SHA17731bd901d24638c0d755f5e9da99a77231fb96e
SHA2565239cce2d52069daff3435a3c4600c21f12f916d190e8a3c37e93b6874528015
SHA5123d3f5d7fab52e77b3811b8555864c3ea2691a14286e2527ce0555e169aab3a94babbb7a9e1de9834212c0f2b696401fe5fee236675a6ad54e96a6de342e07ffb
-
Filesize
4KB
MD5e637b263af7977209db69cf46607af73
SHA1e06c3ab858c1945e977c8634835d5bb80eefa323
SHA256e47336a9b3f503e05636e0d63c8a86cc4a2e7ac86e01466bb523e55711e11ff8
SHA512f62f516f1e9758dcdc4075b139c77064ea891eedeb5967c544b6c4c67d7036db19f65f5230234f2a7ccfd37a98f163308797e6d32bfc8747706d50dbd406b694
-
Filesize
1016KB
MD5ee47200f60aa0ffe7e554db291da8a8f
SHA1a2ab0c657b6045b98aca1befb1fe2ce02ca0ae9e
SHA256b505a14159df87ac31bceb15aea66f17b93c59dd140fc6252988f05b9cef96a7
SHA51202512eaff12cf835116833bead2006aa14e4f86e65f0225887e5d9e2b7a199849222bd15d50bf269e23646192f7cde45f9cb3746964bb6d3e6d325b4d250d478
-
Filesize
544KB
MD54a4a2c83059d4094657c3af4a562be0e
SHA17148c7a5e67cad8dfe972c49f4f694e67d83fefc
SHA2568160e5defad5b538c4096d3bfe2d38dad468cd725e7ff993a7ac7fae4d20fb97
SHA512ab10677e97374fdf4e1e2c9681fdc1085a4716f01289d4fda24714c367cc4bf06ab3e1c7a9054cf75f2c7996d8aaac6a98cb18a41fb95c27fce5e17f4d40c9aa
-
Filesize
320KB
MD51fa6b18a54e9d48d0c2934d9c3537fc1
SHA1ccbb3c67581a3eaca3eddd89ee6c60080dcd6ab1
SHA2566b39f39fd546a299caabde08224d29ab0e02c0aa52170493c6c5fa4c31adaf76
SHA512a5a51cf03ad3f2fed708ee84ff017a87eaa1b1ea6b6c556fba7519508e1865dcad511d9f5245ea8d0b40ce588c7d1376a9613a41f3bbf63606e7fde1a3e26d43
-
Filesize
736KB
MD56156cffaa33f0ec2da64f97ce5116a79
SHA1ff2b223f3da9597bb3c55d9e19c74da522c8b4d2
SHA256fa88e012ef861299a664ee33c51ab95ebf16c3f2a41c8832adb5686a5d2f8425
SHA51298c37c6672a28e85bb706c1c10f7ccdd0e5bc8ac09c677f6df3e15256b8b93956e3392bff4e1b9c68d779ce383d631f33c18dc18d3387d4f11c121a15278ec55