Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05/02/2022, 21:26
Static task
static1
Behavioral task
behavioral1
Sample
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
Resource
win10v2004-en-20220112
General
-
Target
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
-
Size
112KB
-
MD5
65977152d62265c0f46751874bd45767
-
SHA1
3b6aaf8ab4eb82062780202248aad45b916376ab
-
SHA256
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
-
SHA512
c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
http://decrypttozxybarc.onion/0C1C-257D-7431-0006-422B
Signatures
-
Adds policy Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe -
Executes dropped EXE 4 IoCs
pid Process 1624 UserAccountControlSettings.exe 1120 UserAccountControlSettings.exe 1544 UserAccountControlSettings.exe 972 UserAccountControlSettings.exe -
Deletes itself 1 IoCs
pid Process 1740 cmd.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\UserAccountControlSettings.lnk 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\UserAccountControlSettings.lnk UserAccountControlSettings.exe -
Loads dropped DLL 3 IoCs
pid Process 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 1624 UserAccountControlSettings.exe -
Adds Run key to start application 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
pid Process 1680 taskkill.exe 2024 taskkill.exe -
Modifies Control Panel 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000931485939d6973fdbfdb8d915a3ae0c2afb691f41427e0ce91ad0cfadd056c51000000000e8000000002000020000000a6a3aac148c52871052cd5a865e20e34bf200204f1b7488b56ea2340bf3a683390000000c006f0f8df732c1aaf343b21f9dba2274b6407caf6180035a67c36b12222cd22dfa8f1618c0563f1615bb023d73d169f14de2f81bdc1b93fbf3f5fa7fba13e9b39a8fcd7168b95493b4af0f499ed709d8fee2a614cb45069f2cd9b9c77ee497c229f224208b7883c125e83c9096210e5780d410206bac47b23033744fce00d2cf08823d3330dc92993600b34379149e7400000007e035653e156ac193fe1e7bcaa3a6acd5bfbfd3b1c44591a3d05f13cde9a4e8eb2a41a18564ae82cf188c115ac67548a1fdb7dc131720ced2b0437844a0b52f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "350861380" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A7E84A1-86CA-11EC-94AC-F6A981946521} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000001fe15636c462b99c455c2ab6000425c8658a5702275b7e7b5a8ff25964829e43000000000e8000000002000020000000b2fba99876fb4eb8333ab75fc39527480401616d65f80d23a1181b454abc8c9120000000e3ad459ca1548cc97e969d98fdb2e412c903e712e5654a5ee735160167d892b0400000001afbe8ef3566aca0045134fe11a9be13c56b1643fa5239fab0406c07d53fe75b3f27b7ed45baeb87e4489f8e45fb2f0c3fc554b78e28ac58d479fe6b965f6fe5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0684928d71ad801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 1544 PING.EXE 560 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1624 UserAccountControlSettings.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Token: SeDebugPrivilege 1624 UserAccountControlSettings.exe Token: SeIncBasePriorityPrivilege 1624 UserAccountControlSettings.exe Token: SeTakeOwnershipPrivilege 1624 UserAccountControlSettings.exe Token: SeDebugPrivilege 1680 taskkill.exe Token: SeDebugPrivilege 1120 UserAccountControlSettings.exe Token: SeDebugPrivilege 1544 UserAccountControlSettings.exe Token: SeDebugPrivilege 972 UserAccountControlSettings.exe Token: SeDebugPrivilege 2024 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 944 iexplore.exe 944 iexplore.exe 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 848 wrote to memory of 1624 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 27 PID 848 wrote to memory of 1624 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 27 PID 848 wrote to memory of 1624 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 27 PID 848 wrote to memory of 1624 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 27 PID 848 wrote to memory of 1740 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 28 PID 848 wrote to memory of 1740 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 28 PID 848 wrote to memory of 1740 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 28 PID 848 wrote to memory of 1740 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 28 PID 1740 wrote to memory of 1680 1740 cmd.exe 30 PID 1740 wrote to memory of 1680 1740 cmd.exe 30 PID 1740 wrote to memory of 1680 1740 cmd.exe 30 PID 1740 wrote to memory of 1680 1740 cmd.exe 30 PID 1740 wrote to memory of 560 1740 cmd.exe 32 PID 1740 wrote to memory of 560 1740 cmd.exe 32 PID 1740 wrote to memory of 560 1740 cmd.exe 32 PID 1740 wrote to memory of 560 1740 cmd.exe 32 PID 1624 wrote to memory of 1120 1624 UserAccountControlSettings.exe 35 PID 1624 wrote to memory of 1120 1624 UserAccountControlSettings.exe 35 PID 1624 wrote to memory of 1120 1624 UserAccountControlSettings.exe 35 PID 1624 wrote to memory of 1120 1624 UserAccountControlSettings.exe 35 PID 1624 wrote to memory of 1544 1624 UserAccountControlSettings.exe 36 PID 1624 wrote to memory of 1544 1624 UserAccountControlSettings.exe 36 PID 1624 wrote to memory of 1544 1624 UserAccountControlSettings.exe 36 PID 1624 wrote to memory of 1544 1624 UserAccountControlSettings.exe 36 PID 1624 wrote to memory of 1964 1624 UserAccountControlSettings.exe 37 PID 1624 wrote to memory of 1964 1624 UserAccountControlSettings.exe 37 PID 1624 wrote to memory of 1964 1624 UserAccountControlSettings.exe 37 PID 1624 wrote to memory of 1964 1624 UserAccountControlSettings.exe 37 PID 1624 wrote to memory of 944 1624 UserAccountControlSettings.exe 39 PID 1624 wrote to memory of 944 1624 UserAccountControlSettings.exe 39 PID 1624 wrote to memory of 944 1624 UserAccountControlSettings.exe 39 PID 1624 wrote to memory of 944 1624 UserAccountControlSettings.exe 39 PID 1624 wrote to memory of 1548 1624 UserAccountControlSettings.exe 40 PID 1624 wrote to memory of 1548 1624 UserAccountControlSettings.exe 40 PID 1624 wrote to memory of 1548 1624 UserAccountControlSettings.exe 40 PID 1624 wrote to memory of 1548 1624 UserAccountControlSettings.exe 40 PID 1624 wrote to memory of 972 1624 UserAccountControlSettings.exe 41 PID 1624 wrote to memory of 972 1624 UserAccountControlSettings.exe 41 PID 1624 wrote to memory of 972 1624 UserAccountControlSettings.exe 41 PID 1624 wrote to memory of 972 1624 UserAccountControlSettings.exe 41 PID 944 wrote to memory of 856 944 iexplore.exe 43 PID 944 wrote to memory of 856 944 iexplore.exe 43 PID 944 wrote to memory of 856 944 iexplore.exe 43 PID 944 wrote to memory of 856 944 iexplore.exe 43 PID 1624 wrote to memory of 708 1624 UserAccountControlSettings.exe 47 PID 1624 wrote to memory of 708 1624 UserAccountControlSettings.exe 47 PID 1624 wrote to memory of 708 1624 UserAccountControlSettings.exe 47 PID 1624 wrote to memory of 708 1624 UserAccountControlSettings.exe 47 PID 708 wrote to memory of 2024 708 cmd.exe 49 PID 708 wrote to memory of 2024 708 cmd.exe 49 PID 708 wrote to memory of 2024 708 cmd.exe 49 PID 708 wrote to memory of 1544 708 cmd.exe 50 PID 708 wrote to memory of 1544 708 cmd.exe 50 PID 708 wrote to memory of 1544 708 cmd.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe" -watchdog3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe" -stat 1263⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵PID:1964
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:944 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:856
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵PID:1548
-
-
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe" -stat 1263⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "UserAccountControlSettings.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\system32\taskkill.exetaskkill /t /f /im "UserAccountControlSettings.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:1544
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:560
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1660
-
C:\Windows\system32\taskeng.exetaskeng.exe {B828715E-E055-47A6-A041-3A3B11270774} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵PID:1816