73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111

Analysis

max time kernel
23s
max time network
16s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/11/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Size

90KB
MD5

a876db93b22ea5a07ae5053661b918c0
SHA1

add010691eaaacb7c0cd693adc3cd70c89b3d7c3
SHA256

73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111
SHA512

d7926983d395af1824bcb3513cf9131ca02a9b6c479de0c115f3dcb6f9ce5f271edab6f281fa86a5ad97ac9180d32850ed590e7b19f5b137f912869243510247
SSDEEP

1536:XRsjdLaslqdBXvTUL0Hnouy8Vj8QURsjdLaslqdBXvTUL0Hnouy8Vj9:XOJKqsout9gOJKqsout99

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2992	xk.exe
2116	IExplorer.exe
2020	WINLOGON.EXE
1820	CSRSS.EXE
1692	SERVICES.EXE
1888	LSASS.EXE
1276	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
File created	C:\Windows\SysWOW64\shell.exe	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
File created	C:\Windows\SysWOW64\Mig2.scr	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2824-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0008000000015cee-8.dat	upx
behavioral1/files/0x0006000000016c88-121.dat	upx
behavioral1/files/0x0006000000016cf5-125.dat	upx
behavioral1/memory/2824-138-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d3a-147.dat	upx
behavioral1/memory/1692-156-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1888-164-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d43-163.dat	upx
behavioral1/files/0x0006000000016d4b-174.dat	upx
behavioral1/memory/1276-179-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2824-180-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1888-167-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1820-146-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d2a-143.dat	upx
behavioral1/memory/2020-135-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2116-124-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2992-113-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0007000000015d2a-110.dat	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
File created	C:\Windows\xk.exe	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
2992	xk.exe
2116	IExplorer.exe
2020	WINLOGON.EXE
1820	CSRSS.EXE
1692	SERVICES.EXE
1888	LSASS.EXE
1276	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2992	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	30
PID 2824 wrote to memory of 2992	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	30
PID 2824 wrote to memory of 2992	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	30
PID 2824 wrote to memory of 2992	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	30
PID 2824 wrote to memory of 2116	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	31
PID 2824 wrote to memory of 2116	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	31
PID 2824 wrote to memory of 2116	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	31
PID 2824 wrote to memory of 2116	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	31
PID 2824 wrote to memory of 2020	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	32
PID 2824 wrote to memory of 2020	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	32
PID 2824 wrote to memory of 2020	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	32
PID 2824 wrote to memory of 2020	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	32
PID 2824 wrote to memory of 1820	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	33
PID 2824 wrote to memory of 1820	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	33
PID 2824 wrote to memory of 1820	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	33
PID 2824 wrote to memory of 1820	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	33
PID 2824 wrote to memory of 1692	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	34
PID 2824 wrote to memory of 1692	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	34
PID 2824 wrote to memory of 1692	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	34
PID 2824 wrote to memory of 1692	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	34
PID 2824 wrote to memory of 1888	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	35
PID 2824 wrote to memory of 1888	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	35
PID 2824 wrote to memory of 1888	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	35
PID 2824 wrote to memory of 1888	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	35
PID 2824 wrote to memory of 1276	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	36
PID 2824 wrote to memory of 1276	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	36
PID 2824 wrote to memory of 1276	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	36
PID 2824 wrote to memory of 1276	2824	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe	36

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe

C:\Users\Admin\AppData\Local\Temp\73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe
"C:\Users\Admin\AppData\Local\Temp\73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2824
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2992
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2116
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2020
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1820
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1692
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1888
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
90KB

MD5
b36997cae382a6ddd5d0fc5f74708ad9

SHA1
8ef1ff3bd5c10756480d2d0f46769c59dbd78c2d

SHA256
c78747565780d319665cfd96fe96ae632f77b652b89c73a8d2221dddf7221034

SHA512
013fa77f4012796fee43c8b9a934fd068cdc6a56965b9fe9fb906f99175d3efff41d5baf84d8cb58be824052e350480d94deafd15363e35d97ce9d5c2aed5e4e

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
90KB

MD5
4476d208ece92a34138575628d078477

SHA1
1058d82dece24af8533202f4ccc75f03100e233f

SHA256
74348799f80d15168b8784be7a96d78ac9d910bf825b7de9eed205d3d06cb688

SHA512
c183f83714c37fc00c6949b79e47c0c39a252b53915fbe867abdd2d214ba0cc29397fd4a0a12e0368aeadee5651740d1693b1dc6c5df8d468de5f1471edf7037

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
90KB

MD5
915d833095810edcf0a4213e2e09a7c2

SHA1
6d521d93ed1f42a43d0e4b5093a28d48af020957

SHA256
b63b70d8598c545f06daebecb5b139931e1717fe0e40b489a42fa95bb21f78de

SHA512
7512ab3bf38a9011a353371d82e6dc70c0783bc436f88aa87a9a1067ed513535665a13e9a8668ced3cb96b7d68308e8e1268eb55243a7aa729d523b3d82613a6

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
90KB

MD5
a876db93b22ea5a07ae5053661b918c0

SHA1
add010691eaaacb7c0cd693adc3cd70c89b3d7c3

SHA256
73c6be724a6f4e3979f753378d3e1e230f1806affa2a59441099af00b19c6111

SHA512
d7926983d395af1824bcb3513cf9131ca02a9b6c479de0c115f3dcb6f9ce5f271edab6f281fa86a5ad97ac9180d32850ed590e7b19f5b137f912869243510247

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
90KB

MD5
f932b4028d2fec39d5f1960160ef06b2

SHA1
6b443f7150b1dbff539bce0a08e5c883bc01cf39

SHA256
c858da580c1e63502d5071c3b26403c2f9b9c6e78f92ea092bca067168c43402

SHA512
e06179f2baed1ee49d7153c4524f5deeb4b27cf9ebd548a927dfc2cf6e735ffd4dee2d1c3a3d76d0db5fe970c63a7db2f2b94ac9d84fda605cd71964585218b3

Download Submit
C:\Windows\xk.exe

Filesize
90KB

MD5
1e5a3bf6ccdba7e02bf95d7c36238573

SHA1
e71974527e8adc6b0d2f3f027bf197a9fd77a56a

SHA256
e929c76d22d09e8b37c4c9fbad96bf981d54623e154826e7e33daf9aa5f4528c

SHA512
168a9a1badb55dd20fd7f6428ac9caebacb744a0b53276d0376e2129da7e312fd8a8ccc6227e2f84624cc4d16fdb9ea034ec2eb4d2f3d9510bbe2aeeab26e634

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
90KB

MD5
8d66f7e957fa19ea3a10fb217ccac073

SHA1
e38776eeca8be8da3f7bc8efd03f4f1f8aca3ec4

SHA256
e0a87420f3d428c00a4d17bdf0914b7a3ebee912bd7fb34742caf39cb8f7a6e4

SHA512
ca8411b0a770fa13f1303f88ac73d188e0c79ca774b36fb137a028bcd8799a9ea7dbd47f0baec0406c584467df33b63ba0042628a6e6d701c1cf6e6071c6309d

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
90KB

MD5
68dbf6e8967cb19c79cf115ab569c443

SHA1
8ac4210fda06288c5e03d732d8eecf06bceb15c6

SHA256
f33c558793214166aa7f12c6e9143892d7cba6c5f30d6d0d53438ea0af892d05

SHA512
cae947c8e7acd609148f115f1d1acc12a4b6b9f622338a6782727add0323a65f2073735382f49fd1082055930bea545f41b20108b8f0dbb5cef54537901c0df8

Download Submit
memory/1276-179-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1692-156-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1820-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1888-164-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1888-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2020-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2116-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-180-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-131-0x0000000000330000-0x000000000035F000-memory.dmp

Filesize
188KB

Download
memory/2824-120-0x0000000000330000-0x000000000035F000-memory.dmp

Filesize
188KB

Download
memory/2824-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-109-0x0000000000330000-0x000000000035F000-memory.dmp

Filesize
188KB

Download
memory/2992-113-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download