dac4b5511343cf863832e38886af8a3e1d55529648314eb02cc21fa3979f6419

Analysis

user interaction
yes
max time kernel
73s
max time network
71s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Abantes.exe
Size 2.7MB
Sample260822-ty2tzshr71
SHA256 dac4b5511343cf863832e38886af8a3e1d55529648314eb02cc21fa3979f6419
MD5 cd2e58136d3049e9be40ae29f9250c93
SHA1 e97beb8b87d130e5c5745981e3614ed6aa3caae3
SHA512 3ad23ad35d23acfa9edc187f443f28c4bb11279472632726f450b10cc09a653e10f4832f9cca44d063ad1259de6c7017ca6ca8f64ed07d302c3b2d06628f0ba7
SSDEEP 49152:yi98eUDa7+tCg3e+zNWZjUDa7+tCg3e+zNWyUDa7+tCg3e+zNWR9Bh:yAC+7+p3ej2+7+p3ejh+7+p3ejDBh
TLSH
T140D5E113A6D0C521E5FA3B709B7289E90B367E18ACA0E5AF11153D8F3F716438C3576A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe, C:\\Windows\\Defender\\Abantes.exe"	Abantes.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 49 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdge.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgrade.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgradeui.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsrchvw.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SnippingTool.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgrade.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StikyNot.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ehshell.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVDMaker.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVDMaker.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsrchvw.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SnippingTool.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgradeui.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StikyNot.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdge.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ehshell.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1760	netsh.exe

Possible privilege escalation attempt 14 IoCs

exploit

pid	Process
108	icacls.exe
2564	icacls.exe
716	takeown.exe
1776	takeown.exe
2940	icacls.exe
3364	icacls.exe
52	icacls.exe
1552	takeown.exe
2256	takeown.exe
3648	icacls.exe
5128	takeown.exe
1444	takeown.exe
3176	takeown.exe
5992	icacls.exe

Executes dropped EXE 1 IoCs

pid	Process
3848	Abantes.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1552	takeown.exe
2256	takeown.exe
3648	icacls.exe
716	takeown.exe
5128	takeown.exe
1444	takeown.exe
2940	icacls.exe
52	icacls.exe
2564	icacls.exe
1776	takeown.exe
3176	takeown.exe
3364	icacls.exe
5992	icacls.exe
108	icacls.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Abantes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	Abantes.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\en-US\authui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\en-US\authui.dll.mui	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp"	Abantes.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Defender\LogonUi.exe	Abantes.exe
File created	C:\Windows\Defender\explorer.exe.mui	Abantes.exe
File opened for modification	C:\Windows\Defender	Abantes.exe
File created	C:\Windows\Defender\logonOverwrite.bat	Abantes.exe
File created	C:\Windows\Defender\Payloads.dll	Abantes.exe
File created	C:\Windows\Defender\Rules.exe	Abantes.exe
File created	C:\Windows\Defender\data.bin	Abantes.exe
File created	C:\Windows\Defender\Abantes.exe	Abantes.exe
File created	C:\Windows\Defender\Action.bat	Abantes.exe
File created	C:\Windows\Defender\cursor.cur	Abantes.exe
File created	C:\Windows\Defender\IFEO.exe	Abantes.exe
File created	C:\Windows\Defender\authui.dll.mui	Abantes.exe
File created	C:\Windows\Defender\icon.ico	Abantes.exe
File opened for modification	C:\Windows\Defender\wallpaper.jpg	Abantes.exe
File opened for modification	C:\Windows\en-US\explorer.exe.mui	cmd.exe
File created	C:\Windows\Defender\LogonUIStart.exe	Abantes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6028	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abantes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abantes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2308	timeout.exe
4156	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5844	taskkill.exe

Modifies Control Panel 16 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop\TileWallpaper = "0"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\Arrow = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\UpArrow = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\SizeNWSE = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop\WallpaperStyle = "2"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\Wait = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\Help = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\SizeWE = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\SizeNS = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\SizeNESW = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\No = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\NWPen = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\Hand = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Cursors\SizeAll = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Mouse\MouseTrails = "7"	Abantes.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6116	Abantes.exe
3848	Abantes.exe
240	WMIC.exe
240	WMIC.exe
240	WMIC.exe
240	WMIC.exe
5596	WMIC.exe
5596	WMIC.exe
5596	WMIC.exe
5596	WMIC.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1404	Process not Found
2604	Process not Found
4580	Process not Found
1540	Process not Found
3396	Process not Found
5916	Process not Found
4772	Process not Found
3764	Process not Found
3232	Process not Found
1980	Process not Found
4960	Process not Found
864	Process not Found
3212	Process not Found
2388	Process not Found
6012	Process not Found
2576	Process not Found
3316	Process not Found
2188	Process not Found
5020	Process not Found
4632	Process not Found
4360	Process not Found
4128	Process not Found
5140	Process not Found
5404	Process not Found
4464	Process not Found
6016	Process not Found
3760	Process not Found
2360	Process not Found
5416	Process not Found
5720	Process not Found
5520	Process not Found
5364	Process not Found
2548	Process not Found
4108	Process not Found
4284	Process not Found
620	Process not Found
2316	Process not Found
3856	Process not Found
4516	Process not Found
4828	Process not Found
2704	Process not Found
4868	Process not Found
1332	Process not Found
2476	Process not Found
1396	Process not Found
2848	Process not Found
4552	Process not Found
5048	Process not Found
4724	Process not Found
4536	Process not Found
4416	Process not Found
5032	Process not Found
3536	Process not Found
4644	Process not Found
2868	Process not Found
2020	Process not Found
5848	Process not Found
4656	Process not Found
4456	Process not Found
4568	Process not Found
1988	Process not Found
5308	Process not Found
1496	Process not Found
3116	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6116	Abantes.exe
Token: SeTakeOwnershipPrivilege	1552	takeown.exe
Token: SeTakeOwnershipPrivilege	2256	takeown.exe
Token: SeDebugPrivilege	3848	Abantes.exe
Token: SeTakeOwnershipPrivilege	716	takeown.exe
Token: SeTakeOwnershipPrivilege	5128	takeown.exe
Token: SeTakeOwnershipPrivilege	1444	takeown.exe
Token: SeTakeOwnershipPrivilege	3176	takeown.exe
Token: SeIncreaseQuotaPrivilege	240	WMIC.exe
Token: SeSecurityPrivilege	240	WMIC.exe
Token: SeTakeOwnershipPrivilege	240	WMIC.exe
Token: SeLoadDriverPrivilege	240	WMIC.exe
Token: SeSystemProfilePrivilege	240	WMIC.exe
Token: SeSystemtimePrivilege	240	WMIC.exe
Token: SeProfSingleProcessPrivilege	240	WMIC.exe
Token: SeIncBasePriorityPrivilege	240	WMIC.exe
Token: SeCreatePagefilePrivilege	240	WMIC.exe
Token: SeBackupPrivilege	240	WMIC.exe
Token: SeRestorePrivilege	240	WMIC.exe
Token: SeShutdownPrivilege	240	WMIC.exe
Token: SeDebugPrivilege	240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	240	WMIC.exe
Token: SeRemoteShutdownPrivilege	240	WMIC.exe
Token: SeUndockPrivilege	240	WMIC.exe
Token: SeManageVolumePrivilege	240	WMIC.exe
Token: 33	240	WMIC.exe
Token: 34	240	WMIC.exe
Token: 35	240	WMIC.exe
Token: 36	240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	240	WMIC.exe
Token: SeSecurityPrivilege	240	WMIC.exe
Token: SeTakeOwnershipPrivilege	240	WMIC.exe
Token: SeLoadDriverPrivilege	240	WMIC.exe
Token: SeSystemProfilePrivilege	240	WMIC.exe
Token: SeSystemtimePrivilege	240	WMIC.exe
Token: SeProfSingleProcessPrivilege	240	WMIC.exe
Token: SeIncBasePriorityPrivilege	240	WMIC.exe
Token: SeCreatePagefilePrivilege	240	WMIC.exe
Token: SeBackupPrivilege	240	WMIC.exe
Token: SeRestorePrivilege	240	WMIC.exe
Token: SeShutdownPrivilege	240	WMIC.exe
Token: SeDebugPrivilege	240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	240	WMIC.exe
Token: SeRemoteShutdownPrivilege	240	WMIC.exe
Token: SeUndockPrivilege	240	WMIC.exe
Token: SeManageVolumePrivilege	240	WMIC.exe
Token: 33	240	WMIC.exe
Token: 34	240	WMIC.exe
Token: 35	240	WMIC.exe
Token: 36	240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5596	WMIC.exe
Token: SeSecurityPrivilege	5596	WMIC.exe
Token: SeTakeOwnershipPrivilege	5596	WMIC.exe
Token: SeLoadDriverPrivilege	5596	WMIC.exe
Token: SeSystemProfilePrivilege	5596	WMIC.exe
Token: SeSystemtimePrivilege	5596	WMIC.exe
Token: SeProfSingleProcessPrivilege	5596	WMIC.exe
Token: SeIncBasePriorityPrivilege	5596	WMIC.exe
Token: SeCreatePagefilePrivilege	5596	WMIC.exe
Token: SeBackupPrivilege	5596	WMIC.exe
Token: SeRestorePrivilege	5596	WMIC.exe
Token: SeShutdownPrivilege	5596	WMIC.exe
Token: SeDebugPrivilege	5596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5596	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2396	LogonUI.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 6028	6116	Abantes.exe	89
PID 6028 wrote to memory of 1552	6028	cmd.exe	91
PID 6028 wrote to memory of 2564	6028	cmd.exe	92
PID 6028 wrote to memory of 2256	6028	cmd.exe	93
PID 6028 wrote to memory of 3648	6028	cmd.exe	96
PID 6028 wrote to memory of 716	6028	cmd.exe	97
PID 6028 wrote to memory of 5128	6028	cmd.exe	98
PID 6028 wrote to memory of 1444	6028	cmd.exe	99
PID 6028 wrote to memory of 1776	6028	cmd.exe	100
PID 6028 wrote to memory of 3176	6028	cmd.exe	101
PID 6028 wrote to memory of 2940	6028	cmd.exe	102
PID 6028 wrote to memory of 3364	6028	cmd.exe	103
PID 6028 wrote to memory of 52	6028	cmd.exe	104
PID 6028 wrote to memory of 5992	6028	cmd.exe	105
PID 6028 wrote to memory of 108	6028	cmd.exe	106
PID 6028 wrote to memory of 240	6028	cmd.exe	107
PID 6028 wrote to memory of 5596	6028	cmd.exe	109
PID 6028 wrote to memory of 1760	6028	cmd.exe	110
PID 6028 wrote to memory of 5844	6028	cmd.exe	111
PID 6028 wrote to memory of 2308	6028	cmd.exe	112
PID 6028 wrote to memory of 4156	6028	cmd.exe	113
PID 6116 wrote to memory of 5644	6116	Abantes.exe	355

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Welcome To Hell"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "This Computer has been Infected by the Abantes Trojan. Hope You Enjoy."	Abantes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe

C:\Users\Admin\AppData\Local\Temp\Abantes.exe
"C:\Users\Admin\AppData\Local\Temp\Abantes.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:6116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Defender\Action.bat""
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f logonui.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- - C:\Windows\SysWOW64\icacls.exe
    icacls logonui.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\System32\en-US" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\System32\en-US" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3648
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f explorer.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f regedit.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5128
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f HelpPane.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\Temp" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1776
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\en-US" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\Temp" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2940
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\en-US" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3364
- - C:\Windows\SysWOW64\icacls.exe
    icacls regedit.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:52
- - C:\Windows\SysWOW64\icacls.exe
    icacls explorer.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5992
- - C:\Windows\SysWOW64\icacls.exe
    icacls HelpPane.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:108
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='Abantes Was Here'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:240
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'Abantes Was Here'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
- - C:\Windows\SysWOW64\netsh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5844
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2308
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4156
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /l /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5644

C:\Windows\Defender\Abantes.exe
C:\Windows\Defender\Abantes.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a31055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3160

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000344 000000c8
1⤵
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Abantes.exe

Path C:\Windows\Defender\Abantes.exe
Size 2.7MB
SHA256 dac4b5511343cf863832e38886af8a3e1d55529648314eb02cc21fa3979f6419
MD5 cd2e58136d3049e9be40ae29f9250c93
SHA1 e97beb8b87d130e5c5745981e3614ed6aa3caae3
SHA512 3ad23ad35d23acfa9edc187f443f28c4bb11279472632726f450b10cc09a653e10f4832f9cca44d063ad1259de6c7017ca6ca8f64ed07d302c3b2d06628f0ba7
SSDEEP 49152:yi98eUDa7+tCg3e+zNWZjUDa7+tCg3e+zNWyUDa7+tCg3e+zNWR9Bh:yAC+7+p3ej2+7+p3ejh+7+p3ejDBh
TLSH
T140D5E113A6D0C521E5FA3B709B7289E90B367E18ACA0E5AF11153D8F3F716438C3576A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Action.bat

Path C:\Windows\Defender\Action.bat
Size 1KB
SHA256 d06d5f8501501af5677b133ff7aa531ccf1bf9b2673a1f26117f0420532b599e
MD5 8b3585b4f84496c306b6c082ea6e52ef
SHA1 04bf1cf0f68a571e746fb7c863f71fa70e0e79d3
SHA512 733bb98473fc8b3c8f0f96ff5ccec9212c36f7162742ee124d6a0edd0186e171ec61de97a3268663812802c90d29cd1e5077af72e02f550d94d67ebe106c0591
TLSH
T13C1186F381AE00A6C0336F88418F82979146F17BE25809305DA9230CEFC040ADC666DB
MD5 SHA1 SHA512 TLSH

Submit Download

authui.dll.mui

Path C:\Windows\Defender\authui.dll.mui
Size 21KB
SHA256 6baf83c2c45f0e3a1a1dedc799cce6adb766dabe25baa847f9dd308aae0218eb
MD5 a3a8fb6325f2f4fd31039775be19a9a4
SHA1 dba1acba938c8720b23b992ef77f130b6dbe7428
SHA512 9a03528d3b1a6a0bc3fbce6149d1cf6e21fe629c53d1b93954e6147cdfbf95eb272e75dbf906e38a1981706e71f679fda680cdf8601491ba792576c9b54d043e
SSDEEP 384:4jd/Dd/CGw488rk1aptWcAqTT3kSW6liW:udd/dw488X
TLSH
T177A2CB6263F80624F9F73F745AB946A54A37BCA6BC79C21D0254909E5AB5F20CC30B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe.mui

Path C:\Windows\Defender\explorer.exe.mui
Size 15KB
SHA256 b69b61675531060d350a795a53568ccf19a146060cebb659ebc658a0e8b27fc9
MD5 39f1a6a8b713fcf30afc03ea3c936f85
SHA1 9209b25730c7896e047e5a4fc1da73c294e55c0e
SHA512 82b402b1c94fb8444e9d32f10becad994715667fc36d427faf6ae4f433c8e7025c3ca387e6cae7fb4e14f2e9f36446354c1c2585445fd79e7673b78419232780
SSDEEP 192:WQRGfF2cccc3cccccccccccccccccccccccccccvcccvc/ccccPvvPccccPPcfck:HRGfFMWMQhW
TLSH
T16562A87253D04B11ECB36F314AF187DA9A137CA8BC7A852E4568318D5EAAF20DD31F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3848-26-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/3848-27-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/3848-25-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/6116-6-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

Download

memory/6116-1-0x0000000000110000-0x00000000003C8000-memory.dmp

Download

memory/6116-2-0x0000000005540000-0x0000000005AFA000-memory.dmp

Download

memory/6116-3-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Download

memory/6116-5-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/6116-0-0x00000000746E2000-0x00000000746E3000-memory.dmp

Download

memory/6116-4-0x0000000004EC0000-0x0000000004F14000-memory.dmp

Download

memory/6116-30-0x00000000746E2000-0x00000000746E3000-memory.dmp

Download

memory/6116-31-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/6116-32-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download