29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Size 91KB
Sample250127-zj88eavraq
SHA256 29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff
MD5 199baef133f263ab7872f8448bb8d25b
SHA1 dccec1a8fdb1399dade8e80092239e3326855f54
SHA512 0ef6e0b3bf267b6447a10af77c3d0da1f86008500e9f8c1b18f133e8f917b9369684d7ba139afa02178498370a6bb4eb7c8aab7d7a72534ede29ba9276780bfc
SSDEEP 1536:8AwEmBj3EXHn4x+9az6AwEmBj3EXHn4x+9ax:8GmF3onW+MWGmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
3456	xk.exe
2944	IExplorer.exe
3760	WINLOGON.EXE
4952	CSRSS.EXE
540	SERVICES.EXE
1756	LSASS.EXE
2212	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IExplorer.exe	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
File created	C:\Windows\SysWOW64\shell.exe	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
File created	C:\Windows\SysWOW64\Mig2.scr	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
File created	C:\Windows\xk.exe	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
3456	xk.exe
2944	IExplorer.exe
3760	WINLOGON.EXE
4952	CSRSS.EXE
540	SERVICES.EXE
1756	LSASS.EXE
2212	SMSS.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 3456	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	85
PID 1116 wrote to memory of 3456	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	85
PID 1116 wrote to memory of 3456	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	85
PID 1116 wrote to memory of 2944	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	86
PID 1116 wrote to memory of 2944	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	86
PID 1116 wrote to memory of 2944	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	86
PID 1116 wrote to memory of 3760	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	87
PID 1116 wrote to memory of 3760	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	87
PID 1116 wrote to memory of 3760	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	87
PID 1116 wrote to memory of 4952	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	88
PID 1116 wrote to memory of 4952	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	88
PID 1116 wrote to memory of 4952	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	88
PID 1116 wrote to memory of 540	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	89
PID 1116 wrote to memory of 540	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	89
PID 1116 wrote to memory of 540	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	89
PID 1116 wrote to memory of 1756	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	90
PID 1116 wrote to memory of 1756	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	90
PID 1116 wrote to memory of 1756	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	90
PID 1116 wrote to memory of 2212	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	91
PID 1116 wrote to memory of 2212	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	91
PID 1116 wrote to memory of 2212	1116	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe	91

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe

C:\Users\Admin\AppData\Local\Temp\29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe
"C:\Users\Admin\AppData\Local\Temp\29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1116
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3456
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2944
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3760
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4952
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:540
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1756
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 a8604e4133f67b6ad7d820f904c242d6f0a0e0efdc49f89ceac61a49b4242e7f
MD5 f60b32794b617391e61b49931331334b
SHA1 5d44966d4267389a48389e0309b80b2fe1450322
SHA512 77f366d7baab64e80cd79766ff7c8e2218dbaaf547ffcd40eab73bbcb39824287a201df38d79c241c25ad76862708a4c272af42fe1c7e60c686e96f113b891d3
SSDEEP 1536:8AwEmBj3EXHn4x+9ahAwEmBj3EXHn4x+9ax:8GmF3onW+MhGmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 55211a225e9adcc03138c32563d29f2069f147dfd712a5ad73549499fd9f8a08
MD5 b6617b1abe1ffa885e739397c72611e7
SHA1 59677ebb1556a50046bd03cf6a5e6db719f3200f
SHA512 9556296110fbded643a34dfd5dc0d48c869cd8bb3bcf4dfd55d9726b47a77138a4f2df52f8107f7b780ce5ab743053e93d0b1540a9d4706e51e3f0b3c8d998da
SSDEEP 1536:8AwEmBj3EXHn4x+9azAwEmBj3EXHn4x+9ax:8GmF3onW+MzGmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 e54b3458a9b79db379e0773cdb364ef34c7639161a73d5192e49c325b4cb537a
MD5 f3d5dc058da04ddf5b2458a9ce0fec99
SHA1 064e8a0d4cb291f4d77c4d4e98f1bf59b1f4938d
SHA512 1b98274681e756ce27ff4667f0149903e979a466a7e8cede8cdff2f9034bd7fb5a70ffc4adeaedc574dd9ab64e1a758086ebcb0ccc4a0ecb50b1683b2b5dadbc
SSDEEP 1536:8AwEmBj3EXHn4x+9apAwEmBj3EXHn4x+9ax:8GmF3onW+MpGmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 737f1e9b4692ed5a6a8d452885cdd9610e86d556f940b29db08efea8ac7aa0ab
MD5 237b3afb744b0f8202deff4fff3d291f
SHA1 5448dfa5cbbcb26686f0f3289ce8f103d04a4e21
SHA512 ad68030444da40fb8c844b3b120c3905194f66b1af1591b1753a6faeda4965041a24664df7f15576c378441a696dfbc8db3b8d6fa9794835fb717762cabbec98
SSDEEP 1536:8AwEmBj3EXHn4x+9aoAwEmBj3EXHn4x+9ax:8GmF3onW+MoGmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 07e505f98fca6cce9250208ffa17cf6ef51d1b9dddf769b34da06520398442b5
MD5 c667ede7b4b93726c31d6c8e1c089353
SHA1 0de1d41ae8144d7469d852b6de46e7ee47149ab1
SHA512 a2d5d9bc4b1014fb513d6fc4227b4a42a3bf40db5eaeec34ad22914e77080d7f390583ed5f7a8534313c4d201f1f652a24e4833679af8ad2ad7bb0a092272c3c
SSDEEP 1536:8AwEmBj3EXHn4x+9a6OAwEmBj3EXHn4x+9ax:8GmF3onW+MxGmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 91KB
SHA256 29db64fb4ffd2c3626fde117b94bed1adb272279e5141fc902386a88409bf1ff
MD5 199baef133f263ab7872f8448bb8d25b
SHA1 dccec1a8fdb1399dade8e80092239e3326855f54
SHA512 0ef6e0b3bf267b6447a10af77c3d0da1f86008500e9f8c1b18f133e8f917b9369684d7ba139afa02178498370a6bb4eb7c8aab7d7a72534ede29ba9276780bfc
SSDEEP 1536:8AwEmBj3EXHn4x+9az6AwEmBj3EXHn4x+9ax:8GmF3onW+MWGmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 eaefd5eea4647717bdf4001163b062dbd7f371ecd8b55507b8f631d0b4bdd416
MD5 46a04fb74daf3e6517a6a05b1e155c6f
SHA1 6e49e540c0e8e4082fe8e2ec1e13dc7fcfad5c46
SHA512 86ff910b01da6957f9481c5779694a92019c4c01efc4698c6d403f589455ee32d9c9134ce26ca645e97bc71fdc4d84f49d05ca4fb4fd2b962dbf2c2193461e6e
SSDEEP 1536:8AwEmBj3EXHn4x+9a7AwEmBj3EXHn4x+9ax:8GmF3onW+M7GmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 5e85557fe408950b792a61aad29aaf1d443bb2df3dede63faae18e20d074d4fe
MD5 aeace449693e0233d084695859912344
SHA1 d5736e231f6b2b0735fee9506539af04f345337c
SHA512 64538c7412316204b855eeb03bc728c6a340d2c2f6ed3f785bfa387d3e259dfebc16f14af59c3c6569529760f6ca116120cbecb107140ec3113fc00b05bc8e5b
SSDEEP 1536:8AwEmBj3EXHn4x+9aXAwEmBj3EXHn4x+9ax:8GmF3onW+MXGmF3onW+Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-138-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1116-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1116-154-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1756-145-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2212-152-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2944-117-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3456-111-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3760-121-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3760-127-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4952-131-0x0000000000400000-0x000000000042E000-memory.dmp

Download