Analysis
- max time kernel
146s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 17:14
Behavioral task
behavioral1
Sample
iu1je9lzee4fp4p6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
42 signatures
150 seconds
Behavioral task
behavioral2
Sample
iu1je9lzee4fp4p6.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target iu1je9lzee4fp4p6.exe
- Size 374KB
- Sample260628-vsggjaax2j
- SHA256 cc9add661881b756e15ab1a8e4c873bf2103dea2968f998fa9038daff9d0d9f2
- MD5 c20be4bb795fa6c93365d172e44548ba
- SHA1 72265a5924da8dd5555a5097383f65a3d3e20ce3
- SHA512 f54e9e57610ce147fd7b937a46e12b90226d661ff6b0003578fb30a1b0cc74f653bd9178f58da4a37d3326b9f7a314ca10a18bdc4c586905eda09a7d76501daa
- SSDEEP 6144:mVZ139wz4ZoeETEW1gbpJA3KpSL0pDf2QEKbf:mVZR9ULePJA3KY0pqf+
- TLSH T1D8844A43BBD000BAE5BE453848735619A73AF8214B62EBDF169404ED0F26BC5DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sheetrat Payload 4 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral2/memory/1512-0-0x000001C87D030000-0x000001C87D092000-memory.dmp family_sheetrat_v1 behavioral2/files/0x000e00000001c65b-15.dat family_sheetrat_v1 behavioral2/memory/1712-192-0x000001B60CE80000-0x000001B60CEE2000-memory.dmp family_sheetrat_v1 behavioral2/memory/2084-191-0x0000011504DF0000-0x0000011504E52000-memory.dmp family_sheetrat_v1 - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\svchost.exe," iu1je9lzee4fp4p6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" iu1je9lzee4fp4p6.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iu1je9lzee4fp4p6.exe - Executes dropped EXE 40 IoCs
pid Process 3744 Process not Found 476 Process not Found 3544 Process not Found 2596 Process not Found 5316 Process not Found 3536 Process not Found 1556 Process not Found 2932 Process not Found 4996 Process not Found 4504 Process not Found 2540 Process not Found 1544 Process not Found 748 Process not Found 1344 Process not Found 948 Process not Found 4884 Process not Found 3696 Process not Found 1328 Process not Found 2700 Process not Found 3096 Process not Found 4456 Process not Found 3472 Process not Found 712 Process not Found 2084 svchost.exe 1712 Registry.exe 2460 Process not Found 5360 Process not Found 2196 Process not Found 3192 Process not Found 3572 Process not Found 3560 Process not Found 3764 Process not Found 2228 Process not Found 2368 Process not Found 2064 Process not Found 1860 Process not Found 3620 Process not Found 1640 Process not Found 4584 Process not Found 3452 Process not Found - Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx Process not Found - Loads dropped DLL 64 IoCs
pid Process 748 Process not Found 4996 Process not Found 5900 Process not Found 4456 Process not Found 2700 Process not Found 3472 Process not Found 4348 Process not Found 1668 Process not Found 1648 Process not Found 5920 Process not Found 3204 CMD.exe 3744 Process not Found 3544 Process not Found 5316 Process not Found 3536 Process not Found 476 Process not Found 2596 Process not Found 2540 Process not Found 4504 Process not Found 2932 Process not Found 1544 Process not Found 1344 Process not Found 948 Process not Found 4884 Process not Found 3696 Process not Found 1556 Process not Found 1328 Process not Found 3096 Process not Found 712 Process not Found 1712 Registry.exe 4996 Process not Found 748 Process not Found 2084 svchost.exe 5900 Process not Found 476 Process not Found 3544 Process not Found 3928 Process not Found 2540 Process not Found 3764 Process not Found 2596 Process not Found 5316 Process not Found 3536 Process not Found 4456 Process not Found 4348 Process not Found 2932 Process not Found 1556 Process not Found 948 Process not Found 3744 Process not Found 4504 Process not Found 1544 Process not Found 3696 Process not Found 1328 Process not Found 5576 Process not Found 2700 Process not Found 3472 Process not Found 2368 Process not Found 2228 Process not Found 4884 Process not Found 2064 Process not Found 3096 Process not Found 1668 Process not Found 3620 Process not Found 1648 Process not Found 3452 Process not Found - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iu1je9lzee4fp4p6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml Process not Found File opened for modification C:\Windows\System32\Tasks\svchost.exe Process not Found File opened for modification C:\Windows\System32\Tasks\WindowsControlW Process not Found File opened for modification C:\Windows\System32\CatRoot2\dberr.txt Process not Found - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe iu1je9lzee4fp4p6.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 56 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100" Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={B919E5E1-59E0-408E-98B9-6910CF1EA870}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269" Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 27 Jun 2026 04:09:01 GMT" Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1782666946" Process not Found - Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2432 schtasks.exe 1584 schtasks.exe 5200 schtasks.exe 3600 schtasks.exe - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1512 iu1je9lzee4fp4p6.exe 1512 iu1je9lzee4fp4p6.exe 1512 iu1je9lzee4fp4p6.exe 1512 iu1je9lzee4fp4p6.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 1712 Registry.exe 1712 Registry.exe 1712 Registry.exe 1712 Registry.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe 2084 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3744 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1512 iu1je9lzee4fp4p6.exe Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeDebugPrivilege 2084 svchost.exe Token: SeDebugPrivilege 1712 Registry.exe Token: SeAuditPrivilege 3472 Process not Found Token: SeAuditPrivilege 3472 Process not Found Token: SeAuditPrivilege 3472 Process not Found Token: SeAuditPrivilege 3472 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeIncBasePriorityPrivilege 2084 svchost.exe Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found Token: SeShutdownPrivilege 3744 Process not Found Token: SeCreatePagefilePrivilege 3744 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 4348 Process not Found - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1512 wrote to memory of 3204 1512 iu1je9lzee4fp4p6.exe 92 PID 1512 wrote to memory of 2652 1512 iu1je9lzee4fp4p6.exe 94 PID 1512 wrote to memory of 1128 1512 iu1je9lzee4fp4p6.exe 95 PID 1512 wrote to memory of 4956 1512 iu1je9lzee4fp4p6.exe 97 PID 1128 wrote to memory of 1584 1128 cmd.exe 102 PID 2652 wrote to memory of 5776 2652 CMD.exe 103 PID 4956 wrote to memory of 2432 4956 cmd.exe 104 PID 3744 wrote to memory of 2328 3744 Process not Found PID 3744 wrote to memory of 2328 3744 Process not Found PID 3744 wrote to memory of 2268 3744 Process not Found PID 3744 wrote to memory of 2268 3744 Process not Found PID 2084 wrote to memory of 2768 2084 svchost.exe 109 PID 2084 wrote to memory of 5444 2084 svchost.exe 110 PID 1712 wrote to memory of 3772 1712 Registry.exe 113 PID 1712 wrote to memory of 616 1712 Registry.exe 114 PID 2768 wrote to memory of 560 2768 CMD.exe 117 PID 616 wrote to memory of 5200 616 cmd.exe 118 PID 3772 wrote to memory of 2688 3772 CMD.exe 119 PID 5444 wrote to memory of 3600 5444 cmd.exe 120 PID 5444 wrote to memory of 3600 5444 cmd.exe 120 - System policy modification 1 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iu1je9lzee4fp4p6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\iu1je9lzee4fp4p6.exe"C:\Users\Admin\AppData\Local\Temp\iu1je9lzee4fp4p6.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1512 -
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\svchost.exe" enable=yes & exit2⤵
- Loads dropped DLL
PID:3204
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "svchost.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "svchost.exe"3⤵PID:5776
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "svchost.exe" /tr "C:\Windows\svchost.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "svchost.exe" /tr "C:\Windows\svchost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1584
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Users\Admin\Registry.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Users\Admin\Registry.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2432
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2084 -
C:\Windows\System32\CMD.exe"CMD" /c schtasks /delete /F /TN "svchost.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\System32\schtasks.exeschtasks /delete /F /TN "svchost.exe"3⤵PID:560
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "svchost.exe" /tr "C:\Windows\svchost.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\System32\schtasks.exeschtasks /create /f /sc onlogon /tn "svchost.exe" /tr "C:\Windows\svchost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3600
-
-
-
C:\Users\Admin\Registry.exeC:\Users\Admin\Registry.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712 -
C:\Windows\System32\CMD.exe"CMD" /c schtasks /delete /F /TN "svchost.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\System32\schtasks.exeschtasks /delete /F /TN "svchost.exe"3⤵PID:2688
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "svchost.exe" /tr "C:\Windows\svchost.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\System32\schtasks.exeschtasks /create /f /sc onlogon /tn "svchost.exe" /tr "C:\Windows\svchost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5200
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\$77temp\2ff2cab5-0b45-4947-ac4a-ebfe801879a6.dll
- Size 147KB
- SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
- MD5 6295c384c45ef898b40608f7af8155db
- SHA1 75111839c370518271e1b625f506062f7ab31c3a
- SHA512 eea64a94234dff73912699c59e1356579509e2bcffe22b066f65843d230875a7d9fb5f6c75a7a0c81395cdd14e0f6e72bff3a7f39ca455f3d7026edd54b4c801
- SSDEEP 3072:n3+8MsFRgZM1a+UwrL0vxmQ4ktFN6y3Fb1:n3KpSL0pD
- TLSH T11FE30807B6E500FBD8B6813585536A19B7BAF4540322EBEB825449FD0F2BBD1ED39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Tasks\svchost.exe
- Size 3KB
- SHA256 7fea9d97fdd4a77a2215275b998882404eaee4a6dfcae765ec5d8ceff7b76d68
- MD5 4e0cc550567ab98d3dd3386c3baebe00
- SHA1 1198e83f285d93222de957c67ec791e3ab859008
- SHA512 48c5b2a8b0b228937269f2c8de739e9fef92c1c5afc9005dc881e91303f01d5267a0caf00ff986935c91b50d12b9d766470e74f82f280e164fed8cb05e572b77
- TLSH T15B61895367EE1109F2F76B6CAEB750218E67BD515938C46D00AC240DCBF3E2299607BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 76KB
- SHA256 64e5cb8fa6378b885a941ca31f5fbf0978220e414fee564b40c4c180c478b621
- MD5 d9106b5609093b9e3867f5edbf9bc79c
- SHA1 9562600ffe23752dc365cfb75c4d92e8d6267f2f
- SHA512 ba2a2555dcacbc10de99fc364c52b3d6a6acdf33ea125e11b4a6146072ee2b9ce63cf2ae0d22887f267a9b0aec5af3a55162a08121c509c2f3b689a0ec4a4a91
- SSDEEP 1536:6XLf+uHWFcR13qlHveqp/VduTIF7xDbMucs+u6uIgacqb4JlvGL7v9fQwosW3ymE:Yh0E
- TLSH T1F6736B0981D8C558C5B61972725DEF77C93A698B330F8DBA30DC73809ED2B012B7A979
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\svchost.exe
- Size 10.0MB
- SHA256 3c7041a1f439001c7ce1312a1ec813773ee849f49f6fa8dcba149cf405c56011
- MD5 a0a5201861a8f69de7b471b3f15176ba
- SHA1 caf20e9b61441beb41c027942fb68a458c7b749c
- SHA512 49184e6a6874d55daf7893c44325c1b8d4affeb3abd2002e2b9ef8b38ecbd1510653d0ceaf2b57b2611dea87524cdf6acdce7ad662c3b051910f48ac72ca0534
- SSDEEP 6144:mVZ139wz4ZoeETEW1gbpJA3KpSL0pDf2QEKbf:mVZR9ULePJA3KY0pqf+
- TLSH T1E2B64A43BBD000BAE5BE453848735619A73AF8214B62EBDF169404ED0F26BC5DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Tasks\WindowsControlW
- Size 3KB
- SHA256 10e69a36b008ec5fe91a14679d55a36a40d85ae5c5bfcdd9de3c85229c004d9f
- MD5 36ffa72908dbf4a39b1b2fafbef21b4a
- SHA1 621c35796a79083b1986a236550beb00a6ed9616
- SHA512 ec1fa8d95c901586bc57b3bbc8c45f00faf2eaef63673df7aadd85caec533d0d2f0c58e945c2ed1fb2b3a098a44ae00c18f1c1ff85185ea2c14109bd666d379c
- TLSH T1E371884367EE0109F2F76B6CAEB750618E677D455938C46D00AC240DCBF3E2289607BB
- MD5 SHA1 SHA512 TLSH