Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 12:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
MACRO 1.0.0.1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
MACRO 1.0.0.1.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target MACRO 1.0.0.1.exe
- Size 4.1MB
- Sample260718-pg46kaew8x
- SHA256 9e8516281daf7f4cf036b3d0245bcc8e37de9c18d04a57e80fdb1f5d3ffcadc1
- MD5 0dcec74f50a4576539ae91d4a5708b85
- SHA1 e2fb2dcb1137cadb88c2ddba34d736c97e05a3aa
- SHA512 3695ff8a566743a2b5241f0406e9fc072586b5fd5828a85c0a60e377bb1d0c50c3f930730f92ba1d34aaed956aeb23ac1b048987acf5d23dc09d77e0aabeccde
- SSDEEP 49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97kkxOm+7TjsPnztyDMmahpe:Vg4midTSJZJotyDv
- TLSH T17B167C13BBC4243AD5AB163A89279759D93BBA612766CD5F07F0085C8E361803E3E35F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe" icsys.ico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe" svchost.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wininit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - UAC bypass 3 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MACRO 1.0.0.1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" MACRO 1.0.0.1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" MACRO 1.0.0.1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion macro 1.0.0.1.exe - Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation spoolsv.exe Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation spoolsv.exe Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation icsys.ico.exe - Executes dropped EXE 10 IoCs
pid Process 2968 icsys.ico.exe 5716 macro 1.0.0.1.exe 5476 wininit.exe 2928 wininit.exe 740 spoolsv.exe 2056 spoolsv.exe 5520 spoolsv.exe 2496 svchost.exe 5448 spoolsv.exe 4544 svchost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wininit = "c:\\windows\\wininit.exe" icsys.ico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Svchost = "c:\\windows\\svchost.exe" icsys.ico.exe - Checks whether UAC is enabled 1 TTPs 12 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MACRO 1.0.0.1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" icsys.ico.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MACRO 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: macro 1.0.0.1.exe File opened (read-only) \??\q: macro 1.0.0.1.exe File opened (read-only) \??\t: macro 1.0.0.1.exe File opened (read-only) \??\u: macro 1.0.0.1.exe File opened (read-only) \??\y: macro 1.0.0.1.exe File opened (read-only) \??\a: macro 1.0.0.1.exe File opened (read-only) \??\e: macro 1.0.0.1.exe File opened (read-only) \??\h: macro 1.0.0.1.exe File opened (read-only) \??\n: macro 1.0.0.1.exe File opened (read-only) \??\z: macro 1.0.0.1.exe File opened (read-only) \??\g: macro 1.0.0.1.exe File opened (read-only) \??\j: macro 1.0.0.1.exe File opened (read-only) \??\l: macro 1.0.0.1.exe File opened (read-only) \??\r: macro 1.0.0.1.exe File opened (read-only) \??\s: macro 1.0.0.1.exe File opened (read-only) \??\v: macro 1.0.0.1.exe File opened (read-only) \??\w: macro 1.0.0.1.exe File opened (read-only) \??\x: macro 1.0.0.1.exe File opened (read-only) \??\k: macro 1.0.0.1.exe File opened (read-only) \??\m: macro 1.0.0.1.exe File opened (read-only) \??\o: macro 1.0.0.1.exe File opened (read-only) \??\b: macro 1.0.0.1.exe File opened (read-only) \??\i: macro 1.0.0.1.exe - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00070000000246fa-17.dat autoit_exe - Drops file in Windows directory 8 IoCs
description ioc Process File created \??\c:\windows\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\svchost.exe svchost.exe File opened for modification C:\Windows\Wininit MACRO 1.0.0.1.exe File opened for modification C:\Windows\Wininit icsys.ico.exe File created \??\c:\windows\wininit.exe icsys.ico.exe File opened for modification \??\c:\windows\wininit.exe icsys.ico.exe File opened for modification \??\c:\windows\wininit.exe wininit.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MACRO 1.0.0.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.ico.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe - Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier macro 1.0.0.1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier macro 1.0.0.1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier macro 1.0.0.1.exe - Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier macro 1.0.0.1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct macro 1.0.0.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion macro 1.0.0.1.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2968 icsys.ico.exe 2968 icsys.ico.exe 5476 wininit.exe 5476 wininit.exe 5476 wininit.exe 5476 wininit.exe 740 spoolsv.exe 740 spoolsv.exe 5476 wininit.exe 5476 wininit.exe 5476 wininit.exe 5476 wininit.exe 5476 wininit.exe 5476 wininit.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe 2496 svchost.exe 2496 svchost.exe 5476 wininit.exe 5476 wininit.exe - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 5716 macro 1.0.0.1.exe 5476 wininit.exe 2496 svchost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe 5716 macro 1.0.0.1.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2968 2568 MACRO 1.0.0.1.exe 87 PID 2568 wrote to memory of 5716 2568 MACRO 1.0.0.1.exe 88 PID 2968 wrote to memory of 5476 2968 icsys.ico.exe 89 PID 5476 wrote to memory of 740 5476 wininit.exe 93 PID 5476 wrote to memory of 2056 5476 wininit.exe 94 PID 5476 wrote to memory of 5520 5476 wininit.exe 95 PID 740 wrote to memory of 2496 740 spoolsv.exe 96 PID 5476 wrote to memory of 5448 5476 wininit.exe 97 PID 5448 wrote to memory of 4544 5448 spoolsv.exe 98 - System policy modification 1 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" MACRO 1.0.0.1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" MACRO 1.0.0.1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MACRO 1.0.0.1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MACRO 1.0.0.1.exe"C:\Users\Admin\AppData\Local\Temp\MACRO 1.0.0.1.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2568 -
C:\Users\Admin\AppData\Roaming\icsys.ico.exeC:\Users\Admin\AppData\Roaming\icsys.ico.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2968 -
C:\windows\wininit.exe"C:\windows\wininit.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of hidden/system files in Explorer
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5476 -
C:\Users\Admin\appdata\roaming\spoolsv.exe"C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:740 -
C:\windows\svchost.exe"C:\windows\svchost.exe"5⤵
- Modifies WinLogon for persistence
- Modifies visibility of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:2496
-
-
-
C:\Users\Admin\appdata\roaming\spoolsv.exe"C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2056
-
-
C:\Users\Admin\appdata\roaming\spoolsv.exe"C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5520
-
-
C:\Users\Admin\appdata\roaming\spoolsv.exe"C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5448 -
C:\windows\svchost.exe"C:\windows\svchost.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4544
-
-
-
-
-
\??\c:\users\admin\appdata\local\temp\macro 1.0.0.1.exe"c:\users\admin\appdata\local\temp\macro 1.0.0.1.exe "2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5716
-
-
\??\c:\windows\wininit.exec:\windows\wininit.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2928
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\macro 1.0.0.1.exe
- Size 1.2MB
- SHA256 b7a4304997eb23497f5a31a6714c3d464473fb1b69f94d5823d03ae4c0fa0c07
- MD5 75b160b781f9bed0d42710d23180134d
- SHA1 a574ac62eea48590b37a7f1cd5c44eb9a2d52e99
- SHA512 264d0046c9a4585af4c9aeeed556599bc0b3dd966f34d398cf2d1644f69d1abcbf0643df4a44144cadb0bb9fa4ff477708ce0aa6af952a0470b8295821f003d6
- SSDEEP 24576:bRaZROMOm8FN7TjsPnzt2heeRhQbJEOeam03JcnSZzvm:lkxOm+7TjsPnztyDMmahp
- TLSH T19A55AE5933A851A9FEB7E077CA52C607C6B1B88A02778B1F01E05AB67F737711A1E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\icsys.ico.exe
- Size 2.9MB
- SHA256 cd2b437a6fd063aa68633e2741df3857e285ae347dfc4556b062584e7669b2ad
- MD5 cfaa567df9afc38b85dc1b0b1075e9c1
- SHA1 76ab66114d9ff592a06188439805d2deb4719eb0
- SHA512 45fec48a483737d4b57f8896431f6af8355606147a57d364cdf987c14b3588be47046578cda50f69aa6c594897affe8b62f38f006708ef341b7cc5b17855423b
- SSDEEP 24576:a2Fu/HGcDdQwWH+7aU2E0lFgG9XqcSUXI+SwBeSwtPpoc+yu0cjZxY6jRt5oHkve:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97E
- TLSH T1BBD55C23BAC4243AC0AB163A8477A7589D3F76613B56CD9F57F0484C8E361807E3A65F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Wininit
- Size 17B
- SHA256 764df4d37a31be29b4d87041c66c520cf72260d05b22c92df5f61e1eb67ef728
- MD5 dc88c4aa03f5180bbece1abdfec93e70
- SHA1 59662d61697f32a522dc6cfeb67202803b311788
- SHA512 f3b434bfa1767976744b80abe90c4d9614aecbacca889571ba90e8c848808bed73d37b21eb56afa51234481c36ba74348bb791f43655be4f0ee9bca8df89ae49
- MD5 SHA1 SHA512