Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 08:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
120 seconds
Behavioral task
behavioral2
Sample
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
22 signatures
120 seconds
General
-
Target
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe
-
Size
320KB
-
MD5
f994621fb8d39133c91165a336bfa517
-
SHA1
02f1f61bd246cbb0a7cd7e1aed69e48628d15d7a
-
SHA256
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715
-
SHA512
e3bd52ae4070e6bab51802247788e91ad5edf66272fc2668bfff14c867636931c53eb19653bb081459e0f9f45bf4dcc9df03933863ff81d0a61c4d688e908b6b
-
SSDEEP
6144:0TwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqRr:qXgvmzFHi0mo5aH0qMzd5807FRPJQPDH
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exemrsbnl.exemrsbnl.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" mrsbnl.exe -
Processes:
mrsbnl.exemrsbnl.exe1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mrsbnl.exe -
Adds policy Run key to start application 2 TTPs 25 IoCs
Processes:
mrsbnl.exe1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exemrsbnl.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvljkxwtpaksfdxecuoec.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvljkxwtpaksfdxecuoec.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvljkxwtpaksfdxecuoec.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "ofsnlvrlemtyiduyti.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "ynyrnvphyejmunce.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "fvhbyhcvnuaenhxau.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynyrnvphyejmunce.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "mfurrdbxsclsebuaxohw.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "zrfbalidxgoufbtyukc.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "ofsnlvrlemtyiduyti.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "zrfbalidxgoufbtyukc.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "fvhbyhcvnuaenhxau.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofsnlvrlemtyiduyti.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvhbyhcvnuaenhxau.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrfbalidxgoufbtyukc.exe" mrsbnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "ynyrnvphyejmunce.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lnl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrfbalidxgoufbtyukc.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrsbnl = "zrfbalidxgoufbtyukc.exe" mrsbnl.exe -
Disables RegEdit via registry modification 6 IoCs
Processes:
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exemrsbnl.exemrsbnl.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mrsbnl.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mrsbnl.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe -
Executes dropped EXE 2 IoCs
Processes:
mrsbnl.exemrsbnl.exepid Process 1944 mrsbnl.exe 5052 mrsbnl.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
Processes:
mrsbnl.exedescription ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power mrsbnl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys mrsbnl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc mrsbnl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager mrsbnl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys mrsbnl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc mrsbnl.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
mrsbnl.exemrsbnl.exe1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "bvljkxwtpaksfdxecuoec.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "ofsnlvrlemtyiduyti.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fnrdstgrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvhbyhcvnuaenhxau.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfhredo = "ofsnlvrlemtyiduyti.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "zrfbalidxgoufbtyukc.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svub = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svub = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynyrnvphyejmunce.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfhredo = "zrfbalidxgoufbtyukc.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvljkxwtpaksfdxecuoec.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvhbyhcvnuaenhxau.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "ofsnlvrlemtyiduyti.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynyrnvphyejmunce.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "ofsnlvrlemtyiduyti.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvhbyhcvnuaenhxau.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "ynyrnvphyejmunce.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "bvljkxwtpaksfdxecuoec.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofsnlvrlemtyiduyti.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "zrfbalidxgoufbtyukc.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrfbalidxgoufbtyukc.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "ynyrnvphyejmunce.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrfbalidxgoufbtyukc.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrfbalidxgoufbtyukc.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svub = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvhbyhcvnuaenhxau.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfhredo = "zrfbalidxgoufbtyukc.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "ynyrnvphyejmunce.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynyrnvphyejmunce.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfhredo = "ynyrnvphyejmunce.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfhredo = "bvljkxwtpaksfdxecuoec.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fnrdstgrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynyrnvphyejmunce.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "ofsnlvrlemtyiduyti.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "bvljkxwtpaksfdxecuoec.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfhredo = "ofsnlvrlemtyiduyti.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fnrdstgrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofsnlvrlemtyiduyti.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "bvljkxwtpaksfdxecuoec.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fnrdstgrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrfbalidxgoufbtyukc.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "zrfbalidxgoufbtyukc.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfhredo = "ynyrnvphyejmunce.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svub = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvljkxwtpaksfdxecuoec.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fnrdstgrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvljkxwtpaksfdxecuoec.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "zrfbalidxgoufbtyukc.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvhbyhcvnuaenhxau.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "bvljkxwtpaksfdxecuoec.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "zrfbalidxgoufbtyukc.exe ." 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe ." 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fnrdstgrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynyrnvphyejmunce.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svub = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "ofsnlvrlemtyiduyti.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "fvhbyhcvnuaenhxau.exe ." 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svub = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvhbyhcvnuaenhxau.exe" mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfhredo = "zrfbalidxgoufbtyukc.exe" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fnrdstgrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvljkxwtpaksfdxecuoec.exe ." mrsbnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ovyjxxjt = "mfurrdbxsclsebuaxohw.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fnrdstgrb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe ." 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "ofsnlvrlemtyiduyti.exe ." 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "zrfbalidxgoufbtyukc.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfurrdbxsclsebuaxohw.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bffny = "mfurrdbxsclsebuaxohw.exe ." mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yhmzprfrcc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofsnlvrlemtyiduyti.exe" mrsbnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svub = "fvhbyhcvnuaenhxau.exe" mrsbnl.exe -
Processes:
mrsbnl.exemrsbnl.exe1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mrsbnl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mrsbnl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
Processes:
mrsbnl.exemrsbnl.exe1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe -
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 www.whatismyip.ca 32 www.whatismyip.ca 39 whatismyip.everdot.org 40 www.whatismyip.ca 28 whatismyip.everdot.org 15 www.showmyipaddress.com 18 www.whatismyip.ca 19 whatismyip.everdot.org 20 whatismyipaddress.com -
Drops file in System32 directory 4 IoCs
Processes:
mrsbnl.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\bffnyvelrmgyvdhygimmufclsyt.fck mrsbnl.exe File created C:\Windows\SysWOW64\bffnyvelrmgyvdhygimmufclsyt.fck mrsbnl.exe File opened for modification C:\Windows\SysWOW64\ynyrnvphyejmuncexkzkdzhbtkqvygzoqjwlwp.tnf mrsbnl.exe File created C:\Windows\SysWOW64\ynyrnvphyejmuncexkzkdzhbtkqvygzoqjwlwp.tnf mrsbnl.exe -
Drops file in Program Files directory 4 IoCs
Processes:
mrsbnl.exedescription ioc Process File opened for modification C:\Program Files (x86)\bffnyvelrmgyvdhygimmufclsyt.fck mrsbnl.exe File created C:\Program Files (x86)\bffnyvelrmgyvdhygimmufclsyt.fck mrsbnl.exe File opened for modification C:\Program Files (x86)\ynyrnvphyejmuncexkzkdzhbtkqvygzoqjwlwp.tnf mrsbnl.exe File created C:\Program Files (x86)\ynyrnvphyejmuncexkzkdzhbtkqvygzoqjwlwp.tnf mrsbnl.exe -
Drops file in Windows directory 4 IoCs
Processes:
mrsbnl.exedescription ioc Process File opened for modification C:\Windows\bffnyvelrmgyvdhygimmufclsyt.fck mrsbnl.exe File created C:\Windows\bffnyvelrmgyvdhygimmufclsyt.fck mrsbnl.exe File opened for modification C:\Windows\ynyrnvphyejmuncexkzkdzhbtkqvygzoqjwlwp.tnf mrsbnl.exe File created C:\Windows\ynyrnvphyejmuncexkzkdzhbtkqvygzoqjwlwp.tnf mrsbnl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
mrsbnl.exemrsbnl.exe1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mrsbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mrsbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe -
Modifies registry class 3 IoCs
Processes:
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exemrsbnl.exemrsbnl.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings mrsbnl.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings mrsbnl.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
mrsbnl.exepid Process 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe 1944 mrsbnl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mrsbnl.exepid Process 5052 mrsbnl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mrsbnl.exedescription pid Process Token: SeDebugPrivilege 1944 mrsbnl.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exedescription pid Process procid_target PID 636 wrote to memory of 1944 636 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe 82 PID 636 wrote to memory of 1944 636 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe 82 PID 636 wrote to memory of 1944 636 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe 82 PID 636 wrote to memory of 5052 636 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe 83 PID 636 wrote to memory of 5052 636 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe 83 PID 636 wrote to memory of 5052 636 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe 83 -
System policy modification 1 TTPs 36 IoCs
Processes:
1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exemrsbnl.exemrsbnl.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" mrsbnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" mrsbnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer mrsbnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mrsbnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mrsbnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" mrsbnl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" mrsbnl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe"C:\Users\Admin\AppData\Local\Temp\1bf36695b0709be363fabd107d3fe8f4b202b1e58b3665408107875839822715.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:636 -
C:\Users\Admin\AppData\Local\Temp\mrsbnl.exe"C:\Users\Admin\AppData\Local\Temp\mrsbnl.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1944
-
-
C:\Users\Admin\AppData\Local\Temp\mrsbnl.exe"C:\Users\Admin\AppData\Local\Temp\mrsbnl.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:5052
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3744
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD52530d1da7c2723fbb5651017da8a942b
SHA1e082c8d09b13ed83fc59d4290d67720ab80f59e0
SHA2564f8ffa5374969c077a6cbc7d89cba82bc5f26b6894259d06ee7289d7d6a72bc4
SHA5126725d70603bdc46894cabf64d49671d0ef66f185532d1dcd0618e43d8d0b633b1834fa0e3565ea451e18c34b2e48dd09f2ad593f30b7e97abf3d4eb9e9519ebc
-
Filesize
280B
MD5a3944076b66313ca4cc02773e6bc341b
SHA153626663062d8bc55402a28d87e17a32971a7ac7
SHA2568ef05961f3b05e24c77716123a25ff6b5417fc68bde65db902a6019506c9bf99
SHA5123f9b0a55c7e9227e6a57330bfd364c9cae63c9bfcec169587faf281733ef595afaa2a4bdfa9065b631ec93586cee8ef2aa0b4ef62758ebe82c6f9b5d45db8ae1
-
Filesize
280B
MD50393a7e1d283d53666635f12b7d71677
SHA17acc2f7d660793e720ae6dce92ab61a476bbdfc3
SHA256185370e7a09557c02b49e709481476cd9ffb277ff1892f844c6fafc4a91eedde
SHA5129692ffb7b53429289a4369c2f3e4e406b03dbd35927a10eeb4b539e31acbde3cfa643e62f52bde46cc50bc241c436b43f4502d83d5495c55daa6dc89022a0ee1
-
Filesize
280B
MD5a344d035282b57ec66ec535acd7e5042
SHA1251cf0c345672f79047fda6b6ae371cf3ddd1f50
SHA256cf0c55c30bcc802dd19644f4987e1be6a1f8310b5fcb9bade46637cb0adc46a2
SHA512f4018a842662f31bccd75d43e99bfaf73f99506b9493b600bdc803360fabac44877dff641bb35cef8d65d4f1f918f1cbcd29279882af6e10dd6ae5ad0a95dd99
-
Filesize
696KB
MD555fac89a0312a8b7731191d456165c3b
SHA1a507787d22f0bef7b3795776e642eaf84e091299
SHA256a9d864dce23858266ced8b5067eac07fa66b0b309e3a8213b5d96fb3ecb439d9
SHA512c6e937979d4afe702b7a3dc1106f7cd22a4101b6414d3a9e08ce455ca0cb8b96e82b42e50edf0e963e27192ed59a7d1115548ba23a97d914325c2a19c3b1c072
-
Filesize
280B
MD57c00b34c123a082b074ed3606ae8831b
SHA1c698b9113e1dff3da421a9219f230624b474befc
SHA2562a183ad633bd5e0d2ad3ca5164164a0392d8bfe4328b8b8e7c2494839debf149
SHA51249b16f2099f57f7b5d8a93f94f965eb265f952a8c80007463184516c2c57520301b96a58b832c054b204111b988d762efa076177e139781d57d599f3d82d4f9f
-
Filesize
280B
MD58e6e2f4443108f36ed0cce3b92e3be0e
SHA19c5e438ff0d81bd00126bd6aa32a7be9eb299057
SHA2562d2d6a8403414f67951018d022bc1ab13c888bab2e51c45bdee981cd210a9677
SHA5129318ba8d64f37e923474de56fe5fa87eee15453ebc30a6aa696b04d854d38a25132b8ab0f97d28ff626d1bbd640a240a356a292d09ded07997dbe2e896f25db5
-
Filesize
280B
MD55ac60573748db453da0cb24dfb2b435b
SHA14f5f7f873aef7663795921496401f56e580e5b1b
SHA256ae2310f96f02a851c88d162b412bbf124e97bf7cc7a92207fe4ca280748522b8
SHA5128d470d38003ef5bcdcdc3528678d1948c3fea2e02be2aa391b93fd3205f15f5717dba59d3734f20cc9874d84e992130264ea79c7476a4a67e2949a9fbf378ccf
-
Filesize
4KB
MD5d7d6af6a325a7f56f4c507cfdcbcf396
SHA115263bb8490ef03c32ef5c81b1e8b6b51508ba94
SHA2566b802623acaf4747cad5afac3d552d91937ad145ee44e274f58b3fb7a3864ca2
SHA5121756c83158526301aeb1e246c2059a8d02a64388954968cf84bffd9edb635c32f49c3b42ed7ba428763da1b888837af81f6f1a885b034d54a91625dbaacca42d