f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc

General

Target

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Size

978KB
MD5

0a57cf93855798d5c2e7d73e3e246273
SHA1

be46616f832c6af9f3d148ca9627e50cf99d18a4
SHA256

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc
SHA512

482aa50e50a901c48485d34e97a8b8fc05e0ff996c13a53182e692a6b710da8d060b69c8eede09a9471797417c30a55f600d76a063082623d159c3e6ad663ec4

Score

10^/10

adware evasion persistence stealer upx

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\ = "管理员取得所有权"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\Command\ = "cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"	regedit.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Executes dropped EXE 1 IoCs

Processes:

WIN7服务.exe

pid process

1960 WIN7服务.exe

pid	process
1960	WIN7服务.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run	regedit.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disabling Security Tools
T1089

Modify Registry
T1112

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

regedit.exef7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\RunOnceComplete = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\Groups = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "2"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "2"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ThumbnailBehavior = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\TabbedBrowsing	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IEWatsonEnabled = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "2"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\Main	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "2"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\RunOnceHasShown = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Groups = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ThumbnailBehavior = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\DEPOff = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\DisableFirstRunCustomize = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1"	regedit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.hao839.com/"	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

regedit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\ScreenSaveActive = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\SCRNSAVE.EXE	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "2"	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop	regedit.exe

Modifies registry class 64 IoCs

Processes:

regedit.exef7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\UnReg\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\解压缩 CAB 文件	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\DevMgr\command\ = "mmc devmgmt.msc"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\服务管理	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Open\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\Attributes = "48"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\UnReg\ = "UnRegister OCX"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\控制面板\command\ = "Control.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Set\ = "属性(&R)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Reg\Command\ = "regsvr32 %1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\DevMgr\icon = "CompMgmtLauncher.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\Command\ = "cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\runas\ = "管理员取得所有权"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Dezinstall\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Open\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\ = "C:\\Windows\\system32\\ieframe.dll,-190"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\Reg	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\UnReg\Command\ = "regsvr32 /u %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\Reg\Command\ = "regsvr32 %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\DevMgr\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\CAB最大压缩\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\服务管理\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\组策略对象编辑器\icon = "mmc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\UnReg\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\Reg\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Dezinstall\command\ = "rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Open\ = "打开主页(&H)"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\HideOnDesktopPerUser	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{889D2FEB-5411-4565-8998-1DD2C5261283}\InprocServer32	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Reg	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\Reg\ = "Register OCX"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\NoAddOns\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Open	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{889D2FEB-5411-4565-8998-1DD2C5261283}\InprocServer32\ = "C:\\Program Files (x86)\\Thunder Network\\Thunder\\BHO\\XunleiBHO7.2.13.3882.dll"	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\ = "管理员取得所有权"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\服务管理\icon = "UI0Detect.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\runas\Command\ = "cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\控制面板	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Reg\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\UnReg\ = "UnRegister DLL "	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Dezinstall	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\控制面板\icon = "Control.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\服务管理\ = "服务(&V)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\服务管理\command\ = "mmc services.msc"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\组策略对象编辑器\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\runas	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\runas\Command\ = "cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{889D2FEB-5411-4565-8998-1DD2C5261283}	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\NoAddOns\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe about:NoAdd-ons"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe,-32528"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Set	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\HideFolderVerbs	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\WantsParseDisplayName	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{889D2FEB-5411-4565-8998-1DD2C5261283}\InprocServer32\ThreadingModel = "Apartment"	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

NTFS ADS 1 IoCs

Processes:

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

432 regedit.exe
2000 regedit.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powercfg.exepowercfg.exe

description pid process

Token: SeShutdownPrivilege 2012 powercfg.exe
Token: SeShutdownPrivilege 908 powercfg.exe

pid	process
432	regedit.exe
2000	regedit.exe

description	pid	process
Token: SeShutdownPrivilege	2012	powercfg.exe
Token: SeShutdownPrivilege	908	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.execmd.execmd.execmd.execmd.exeWIN7服务.execmd.exe

description	pid	process	target process
PID 1932 wrote to memory of 1712	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 1712	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 1712	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1712 wrote to memory of 2000	1712	cmd.exe	regedit.exe
PID 1712 wrote to memory of 2000	1712	cmd.exe	regedit.exe
PID 1712 wrote to memory of 2000	1712	cmd.exe	regedit.exe
PID 1932 wrote to memory of 812	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 812	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 812	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 812 wrote to memory of 432	812	cmd.exe	regedit.exe
PID 812 wrote to memory of 432	812	cmd.exe	regedit.exe
PID 812 wrote to memory of 432	812	cmd.exe	regedit.exe
PID 1932 wrote to memory of 1960	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	WIN7服务.exe
PID 1932 wrote to memory of 1960	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	WIN7服务.exe
PID 1932 wrote to memory of 1960	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	WIN7服务.exe
PID 1932 wrote to memory of 1960	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	WIN7服务.exe
PID 1932 wrote to memory of 1684	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 1684	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 1684	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1684 wrote to memory of 2012	1684	cmd.exe	powercfg.exe
PID 1684 wrote to memory of 2012	1684	cmd.exe	powercfg.exe
PID 1684 wrote to memory of 2012	1684	cmd.exe	powercfg.exe
PID 1932 wrote to memory of 392	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 392	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 392	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 392 wrote to memory of 908	392	cmd.exe	powercfg.exe
PID 392 wrote to memory of 908	392	cmd.exe	powercfg.exe
PID 392 wrote to memory of 908	392	cmd.exe	powercfg.exe
PID 1960 wrote to memory of 1580	1960	WIN7服务.exe	cmd.exe
PID 1960 wrote to memory of 1580	1960	WIN7服务.exe	cmd.exe
PID 1960 wrote to memory of 1580	1960	WIN7服务.exe	cmd.exe
PID 1960 wrote to memory of 1580	1960	WIN7服务.exe	cmd.exe
PID 1932 wrote to memory of 1976	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 1976	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1932 wrote to memory of 1976	1932	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1580 wrote to memory of 1820	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1820	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1820	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1820	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1752	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1752	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1752	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1752	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 880	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 880	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 880	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 880	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1856	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1856	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1856	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1856	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 560	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 560	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 560	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 560	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 316	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 316	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 316	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 316	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1520	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1520	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1520	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 1520	1580	cmd.exe	sc.exe
PID 1580 wrote to memory of 112	1580	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
"C:\Users\Admin\AppData\Local\Temp\f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\system32\cmd.exe
cmd.exe /c regedit /s "C:\Users\Admin\AppData\Local\Temp\WIN7优化.reg"
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\regedit.exe
regedit /s "C:\Users\Admin\AppData\Local\Temp\WIN7优化.reg"
3⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Runs .reg file with regedit
PID:2000

C:\Windows\system32\cmd.exe
cmd.exe /c regedit /s "C:\Users\Admin\AppData\Local\Temp\WIN7优化2.reg"
2⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\regedit.exe
regedit /s "C:\Users\Admin\AppData\Local\Temp\WIN7优化2.reg"
3⤵
- Runs .reg file with regedit
PID:432

C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe
C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\8815.tmp\Win7·þÎñ.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\sc.exe
sc config AeLookupSvc start= DEMAND
4⤵
PID:1820

C:\Windows\SysWOW64\sc.exe
sc config ALG start= DEMAND
4⤵
PID:1752

C:\Windows\SysWOW64\sc.exe
sc config AppIDSvc start= DEMAND
4⤵
PID:880

C:\Windows\SysWOW64\sc.exe
sc config Appinfo start= DEMAND
4⤵
PID:1856

C:\Windows\SysWOW64\sc.exe
sc config AppMgmt start= DEMAND
4⤵
PID:560

C:\Windows\SysWOW64\sc.exe
sc config AudioEndpointBuilder start= AUTO
4⤵
PID:316

C:\Windows\SysWOW64\sc.exe
sc config Audiosrv start= AUTO
4⤵
PID:1520

C:\Windows\SysWOW64\sc.exe
sc config AxInstSV start= DEMAND
4⤵
PID:112

C:\Windows\SysWOW64\sc.exe
sc config BDESVC start= DEMAND
4⤵
PID:1256

C:\Windows\SysWOW64\sc.exe
sc config BFE start= AUTO
4⤵
PID:1028

C:\Windows\SysWOW64\sc.exe
sc config BITS start= AUTO
4⤵
PID:1768

C:\Windows\SysWOW64\sc.exe
sc config Browser start= DEMAND
4⤵
PID:1984

C:\Windows\SysWOW64\sc.exe
sc config bthserv start= DEMAND
4⤵
PID:932

C:\Windows\SysWOW64\sc.exe
sc config CertPropSvc start= DEMAND
4⤵
PID:1988

C:\Windows\SysWOW64\sc.exe
sc config clr_optimization_v2.0.50727_32 start= DEMAND
4⤵
PID:1052

C:\Windows\SysWOW64\sc.exe
sc config COMSysApp start= DEMAND
4⤵
PID:336

C:\Windows\SysWOW64\sc.exe
sc config CryptSvc start= AUTO
4⤵
PID:820

C:\Windows\SysWOW64\sc.exe
sc config CscService start= DISABLED
4⤵
PID:1316

C:\Windows\SysWOW64\sc.exe
sc config DcomLaunch start= AUTO
4⤵
PID:2016

C:\Windows\SysWOW64\sc.exe
sc config defragsvc start= DEMAND
4⤵
PID:1280

C:\Windows\SysWOW64\sc.exe
sc config Dhcp start= AUTO
4⤵
PID:1588

C:\Windows\SysWOW64\sc.exe
sc config Dnscache start= AUTO
4⤵
PID:668

C:\Windows\SysWOW64\sc.exe
sc config dot3svc start= DEMAND
4⤵
PID:808

C:\Windows\SysWOW64\sc.exe
sc config DPS start= DISABLED
4⤵
PID:1264

C:\Windows\SysWOW64\sc.exe
sc config EapHost start= DEMAND
4⤵
PID:1676

C:\Windows\SysWOW64\sc.exe
sc config EFS start= DEMAND
4⤵
PID:1492

C:\Windows\SysWOW64\sc.exe
sc config ehRecvr start= DISABLED
4⤵
PID:1752

C:\Windows\SysWOW64\sc.exe
sc config ehSched start= DEMAND
4⤵
PID:880

C:\Windows\SysWOW64\sc.exe
sc config eventlog start= AUTO
4⤵
PID:1856

C:\Windows\SysWOW64\sc.exe
sc config EventSystem start= AUTO
4⤵
PID:560

C:\Windows\SysWOW64\sc.exe
sc config Fax start= DISABLED
4⤵
PID:1800

C:\Windows\SysWOW64\sc.exe
sc config fdPHost start= DEMAND
4⤵
PID:552

C:\Windows\SysWOW64\sc.exe
sc config FDResPub start= DEMAND
4⤵
PID:112

C:\Windows\SysWOW64\sc.exe
sc config FontCache start= AUTO
4⤵
PID:1256

C:\Windows\SysWOW64\sc.exe
sc config FontCache3.0.0.0 start= DEMAND
4⤵
PID:684

C:\Windows\SysWOW64\sc.exe
sc config gpsvc start= AUTO
4⤵
PID:1768

C:\Windows\SysWOW64\sc.exe
sc config hidserv start= DEMAND
4⤵
PID:1940

C:\Windows\SysWOW64\sc.exe
sc config hkmsvc start= DEMAND
4⤵
PID:1396

C:\Windows\SysWOW64\sc.exe
sc config HomeGroupListener start= DEMAND
4⤵
PID:860

C:\Windows\SysWOW64\sc.exe
sc config HomeGroupProvider start= DEMAND
4⤵
PID:612

C:\Windows\SysWOW64\sc.exe
sc config idsvc start= DEMAND
4⤵
PID:624

C:\Windows\SysWOW64\sc.exe
sc config IKEEXT start= AUTO
4⤵
PID:652

C:\Windows\SysWOW64\sc.exe
sc config IPBusEnum start= DEMAND
4⤵
PID:1160

C:\Windows\SysWOW64\sc.exe
sc config iphlpsvc start= DEMAND
4⤵
PID:1388

C:\Windows\SysWOW64\sc.exe
sc config KeyIso start= DEMAND
4⤵
PID:2012

C:\Windows\SysWOW64\sc.exe
sc config KtmRm start= DISABLED
4⤵
PID:428

C:\Windows\SysWOW64\sc.exe
sc config LanmanServer start= AUTO
4⤵
PID:1448

C:\Windows\SysWOW64\sc.exe
sc config LanmanWorkstation start= AUTO
4⤵
PID:764

C:\Windows\SysWOW64\sc.exe
sc config lltdsvc start= DEMAND
4⤵
PID:1612

C:\Windows\SysWOW64\sc.exe
sc config lmhosts start= AUTO
4⤵
PID:1312

C:\Windows\SysWOW64\sc.exe
sc config Mcx2Svc start= DISABLED
4⤵
PID:2008

C:\Windows\SysWOW64\sc.exe
sc config MMCSS start= AUTO
4⤵
PID:568

C:\Windows\SysWOW64\sc.exe
sc config MpsSvc start= DEMAND
4⤵
PID:304

C:\Windows\SysWOW64\sc.exe
sc config MSDTC start= DEMAND
4⤵
PID:1756

C:\Windows\SysWOW64\sc.exe
sc config MSiSCSI start= DEMAND
4⤵
PID:1868

C:\Windows\SysWOW64\sc.exe
sc config msiserver start= DEMAND
4⤵
PID:592

C:\Windows\SysWOW64\sc.exe
sc config napagent start= DEMAND
4⤵
PID:880

C:\Windows\SysWOW64\sc.exe
sc config Netlogon start= DEMAND
4⤵
PID:1856

C:\Windows\SysWOW64\sc.exe
sc config Netman start= DEMAND
4⤵
PID:1592

C:\Windows\SysWOW64\sc.exe
sc config netprofm start= DEMAND
4⤵
PID:1520

C:\Windows\SysWOW64\sc.exe
sc config NetTcpPortSharing start= DISABLED
4⤵
PID:1032

C:\Windows\SysWOW64\sc.exe
sc config NlaSvc start= AUTO
4⤵
PID:1912

C:\Windows\SysWOW64\sc.exe
sc config nsi start= AUTO
4⤵
PID:864

C:\Windows\SysWOW64\sc.exe
sc config p2pimsvc start= DEMAND
4⤵
PID:1028

C:\Windows\SysWOW64\sc.exe
sc config p2psvc start= DEMAND
4⤵
PID:1356

C:\Windows\SysWOW64\sc.exe
sc config PcaSvc start= DISABLED
4⤵
PID:1408

C:\Windows\SysWOW64\sc.exe
sc config PeerDistSvc start= DEMAND
4⤵
PID:2000

C:\Windows\SysWOW64\sc.exe
sc config pla start= DEMAND
4⤵
PID:952

C:\Windows\SysWOW64\sc.exe
sc config PlugPlay start= AUTO
4⤵
PID:1940

C:\Windows\SysWOW64\sc.exe
sc config PNRPAutoReg start= DEMAND
4⤵
PID:672

C:\Windows\SysWOW64\sc.exe
sc config PNRPsvc start= DEMAND
4⤵
PID:1640

C:\Windows\SysWOW64\sc.exe
sc config PolicyAgent start= DEMAND
4⤵
PID:1552

C:\Windows\SysWOW64\sc.exe
sc config Power start= AUTO
4⤵
PID:1572

C:\Windows\SysWOW64\sc.exe
sc config ProfSvc start= AUTO
4⤵
PID:1052

C:\Windows\SysWOW64\sc.exe
sc config ProtectedStorage start= DEMAND
4⤵
PID:1720

C:\Windows\SysWOW64\sc.exe
sc config QWAVE start= DEMAND
4⤵
PID:652

C:\Windows\SysWOW64\sc.exe
sc config RasAuto start= DEMAND
4⤵
PID:1400

C:\Windows\SysWOW64\sc.exe
sc config RasMan start= DEMAND
4⤵
PID:1360

C:\Windows\SysWOW64\sc.exe
sc config RemoteAccess start= DISABLED
4⤵
PID:1316

C:\Windows\SysWOW64\sc.exe
sc config RemoteRegistry start= DISABLED
4⤵
PID:2012

C:\Windows\SysWOW64\sc.exe
sc config RpcEptMapper start= AUTO
4⤵
PID:1656

C:\Windows\SysWOW64\sc.exe
sc config RpcLocator start= DEMAND
4⤵
PID:1944

C:\Windows\SysWOW64\sc.exe
sc config RpcSs start= AUTO
4⤵
PID:1084

C:\Windows\SysWOW64\sc.exe
sc config SamSs start= AUTO
4⤵
PID:1732

C:\Windows\SysWOW64\sc.exe
sc config SCardSvr start= DEMAND
4⤵
PID:2016

C:\Windows\SysWOW64\sc.exe
sc config Schedule start= AUTO
4⤵
PID:1608

C:\Windows\SysWOW64\sc.exe
sc config SCPolicySvc start= DISABLED
4⤵
PID:1448

C:\Windows\SysWOW64\sc.exe
sc config SDRSVC start= DEMAND
4⤵
PID:1104

C:\Windows\SysWOW64\sc.exe
sc config seclogon start= DISABLED
4⤵
PID:960

C:\Windows\SysWOW64\sc.exe
sc config SENS start= AUTO
4⤵
PID:1588

C:\Windows\SysWOW64\sc.exe
sc config SensrSvc start= DEMAND
4⤵
PID:1508

C:\Windows\SysWOW64\sc.exe
sc config SessionEnv start= DEMAND
4⤵
PID:1268

C:\Windows\SysWOW64\sc.exe
sc config SharedAccess start= DISABLED
4⤵
PID:668

C:\Windows\SysWOW64\sc.exe
sc config ShellHWDetection start= DEMAND
4⤵
PID:1952

C:\Windows\SysWOW64\sc.exe
sc config SNMPTRAP start= DISABLED
4⤵
PID:1264

C:\Windows\SysWOW64\sc.exe
sc config Spooler start= AUTO
4⤵
PID:1088

C:\Windows\SysWOW64\sc.exe
sc config sppsvc start= AUTO
4⤵
PID:1676

C:\Windows\SysWOW64\sc.exe
sc config sppuinotify start= DEMAND
4⤵
PID:1492

C:\Windows\SysWOW64\sc.exe
sc config SSDPSRV start= DEMAND
4⤵
PID:548

C:\Windows\SysWOW64\sc.exe
sc config SstpSvc start= DEMAND
4⤵
PID:1860

C:\Windows\SysWOW64\sc.exe
sc config StiSvc start= DEMAND
4⤵
PID:880

C:\Windows\SysWOW64\sc.exe
sc config swprv start= DEMAND
4⤵
PID:1856

C:\Windows\SysWOW64\sc.exe
sc config SysMain start= AUTO
4⤵
PID:1592

C:\Windows\SysWOW64\sc.exe
sc config TabletInputService start= DEMAND
4⤵
PID:1520

C:\Windows\SysWOW64\sc.exe
sc config TapiSrv start= DEMAND
4⤵
PID:1032

C:\Windows\SysWOW64\sc.exe
sc config TBS start= DEMAND
4⤵
PID:1748

C:\Windows\SysWOW64\sc.exe
sc config TermService start= DEMAND
4⤵
PID:920

C:\Windows\SysWOW64\sc.exe
sc config Themes start= AUTO
4⤵
PID:1784

C:\Windows\SysWOW64\sc.exe
sc config THREADORDER start= DEMAND
4⤵
PID:1256

C:\Windows\SysWOW64\sc.exe
sc config TrkWks start= DISABLED
4⤵
PID:2028

C:\Windows\SysWOW64\sc.exe
sc config TrustedInstaller start= DEMAND
4⤵
PID:1984

C:\Windows\SysWOW64\sc.exe
sc config UI0Detect start= DEMAND
4⤵
PID:1992

C:\Windows\SysWOW64\sc.exe
sc config UmRdpService start= DEMAND
4⤵
PID:932

C:\Windows\SysWOW64\sc.exe
sc config upnphost start= DEMAND
4⤵
PID:1988

C:\Windows\SysWOW64\sc.exe
sc config UxSms start= AUTO
4⤵
PID:1372

C:\Windows\SysWOW64\sc.exe
sc config VaultSvc start= DEMAND
4⤵
PID:860

C:\Windows\SysWOW64\sc.exe
sc config vds start= DEMAND
4⤵
PID:1140

C:\Windows\SysWOW64\sc.exe
sc config VSS start= DEMAND
4⤵
PID:612

C:\Windows\SysWOW64\sc.exe
sc config W32Time start= DEMAND
4⤵
PID:624

C:\Windows\SysWOW64\sc.exe
sc config wbengine start= DEMAND
4⤵
PID:1248

C:\Windows\SysWOW64\sc.exe
sc config WbioSrvc start= DEMAND
4⤵
PID:340

C:\Windows\SysWOW64\sc.exe
sc config wcncsvc start= DEMAND
4⤵
PID:820

C:\Windows\SysWOW64\sc.exe
sc config WcsPlugInService start= DEMAND
4⤵
PID:1388

C:\Windows\SysWOW64\sc.exe
sc config WdiServiceHost start= DISABLED
4⤵
PID:1236

C:\Windows\SysWOW64\sc.exe
sc config WdiSystemHost start= DISABLED
4⤵
PID:1684

C:\Windows\SysWOW64\sc.exe
sc config WebClient start= DEMAND
4⤵
PID:1564

C:\Windows\SysWOW64\sc.exe
sc config Wecsvc start= DEMAND
4⤵
PID:1696

C:\Windows\SysWOW64\sc.exe
sc config wercplsupport start= DISABLED
4⤵
PID:1728

C:\Windows\SysWOW64\sc.exe
sc config WerSvc start= DISABLED
4⤵
PID:1972

C:\Windows\SysWOW64\sc.exe
sc config WinDefend start= DEMAND
4⤵
PID:428

C:\Windows\SysWOW64\sc.exe
sc config WinHttpAutoProxySvc start= DEMAND
4⤵
PID:1616

C:\Windows\SysWOW64\sc.exe
sc config Winmgmt start= AUTO
4⤵
PID:520

C:\Windows\SysWOW64\sc.exe
sc config WinRM start= DISABLED
4⤵
PID:764

C:\Windows\SysWOW64\sc.exe
sc config Wlansvc start= DEMAND
4⤵
PID:1648

C:\Windows\SysWOW64\sc.exe
sc config wmiApSrv start= DEMAND
4⤵
PID:836

C:\Windows\SysWOW64\sc.exe
sc config WMPNetworkSvc start= DEMAND
4⤵
PID:988

C:\Windows\SysWOW64\sc.exe
sc config WPCSvc start= DISABLED
4⤵
PID:656

C:\Windows\SysWOW64\sc.exe
sc config WPDBusEnum start= DEMAND
4⤵
PID:1996

C:\Windows\SysWOW64\sc.exe
sc config wscsvc start= DEMAND
4⤵
PID:808

C:\Windows\SysWOW64\sc.exe
sc config WSearch start= DISABLED
4⤵
PID:1820

C:\Windows\SysWOW64\sc.exe
sc config wuauserv start= AUTO
4⤵
PID:1196

C:\Windows\SysWOW64\sc.exe
sc config wudfsvc start= DEMAND
4⤵
PID:304

C:\Windows\SysWOW64\sc.exe
sc config WwanSvc start= DEMAND
4⤵
PID:1752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powercfg -change -monitor-timeout-ac 15
2⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\system32\powercfg.exe
powercfg -change -monitor-timeout-ac 15
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powercfg -change -standby-timeout-ac 0
2⤵
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\system32\powercfg.exe
powercfg -change -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c del /f /s /q %windir%\*.bak
2⤵
PID:1976

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

2

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

6

T1112

Disabling Security Tools

1

T1089

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8815.tmp\Win7·þÎñ.bat
Filesize
5KB

MD5
49efc4c8ac66c2abce02c89024c2d706

SHA1
bac073d6839819f7e492a651e28ddeaef13d3c52

SHA256
2669563af2fd6f7519db936a899ed3fd431214f7742b855db702d5e74b32c34e

SHA512
828e9ccaca818174ffd6f9ae9fe933eb84fbbbef1556fc73bca8d0a71b01d57cc443ba8e54b048d4859b37bdafd5e0bd6d8a807972b349dfefff94f0734734b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WIN7优化.reg
Filesize
32KB

MD5
fd27cb1190fbd22a8ab0aeb5571ae411

SHA1
c856be5e2d203b6057fde26690c5c25b4c7fc39d

SHA256
792e23f946a93b8d444e55b7ba59246000daa39293f557388883d40491edfeb6

SHA512
2bf3d39f80ed1dc79869dd3e0bdaa7aed92c204e4c9ca963584be9c6c3acf7127a2c7aaf39e4cddf1d4798e5f29f5b993c57d0f32e32e143f93ae98ab4848265

Download Submit
C:\Users\Admin\AppData\Local\Temp\WIN7优化2.reg
Filesize
974B

MD5
8fc60d0f06d32a7949710c6a1a1de036

SHA1
19f8e1f33fef6681cf56d783dc02c92421978b66

SHA256
411161d4a4cf5dc07f9eb2398c31fbb83bf5b7f76d2bd9dced759719f12c36fa

SHA512
e96596701c612fe54d711c0408b8461f1b665b2f6a1a7a5ee9d1d3dbc24c1bcb8434b0def86c3701f9540b7597cb8905d4aee1b0b55d4fabad0d8bfff8d5a8df

Download Submit
C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe
Filesize
31KB

MD5
25e6a394a01e13ed75c5cae03eb63a23

SHA1
9d88f80e6db01fc8fcaf0518976706e1f6a94e0d

SHA256
49f7526676569f75456d41ad027bc2cd687b6f03aac1f74565d05b6a7f771e4a

SHA512
f053fe79dcc7383c43260c1a3820a9ed47ff51872ed053943d1b8c7be3fa9f1ce983fba4da2c8a2abcd8f6eecb390c6c6020993b5ecea7dbf035e59f6548fc18

Download Submit
memory/112-80-0x0000000000000000-mapping.dmp

Download
memory/112-105-0x0000000000000000-mapping.dmp

Download
memory/304-125-0x0000000000000000-mapping.dmp

Download
memory/316-78-0x0000000000000000-mapping.dmp

Download
memory/336-88-0x0000000000000000-mapping.dmp

Download
memory/392-68-0x0000000000000000-mapping.dmp

Download
memory/428-118-0x0000000000000000-mapping.dmp

Download
memory/432-60-0x0000000000000000-mapping.dmp

Download
memory/552-104-0x0000000000000000-mapping.dmp

Download
memory/560-77-0x0000000000000000-mapping.dmp

Download
memory/560-102-0x0000000000000000-mapping.dmp

Download
memory/568-124-0x0000000000000000-mapping.dmp

Download
memory/612-112-0x0000000000000000-mapping.dmp

Download
memory/624-113-0x0000000000000000-mapping.dmp

Download
memory/652-114-0x0000000000000000-mapping.dmp

Download
memory/668-94-0x0000000000000000-mapping.dmp

Download
memory/684-107-0x0000000000000000-mapping.dmp

Download
memory/764-120-0x0000000000000000-mapping.dmp

Download
memory/808-95-0x0000000000000000-mapping.dmp

Download
memory/812-59-0x0000000000000000-mapping.dmp

Download
memory/820-89-0x0000000000000000-mapping.dmp

Download
memory/860-111-0x0000000000000000-mapping.dmp

Download
memory/880-100-0x0000000000000000-mapping.dmp

Download
memory/880-75-0x0000000000000000-mapping.dmp

Download
memory/908-69-0x0000000000000000-mapping.dmp

Download
memory/932-85-0x0000000000000000-mapping.dmp

Download
memory/1028-82-0x0000000000000000-mapping.dmp

Download
memory/1052-87-0x0000000000000000-mapping.dmp

Download
memory/1160-115-0x0000000000000000-mapping.dmp

Download
memory/1256-81-0x0000000000000000-mapping.dmp

Download
memory/1256-106-0x0000000000000000-mapping.dmp

Download
memory/1264-96-0x0000000000000000-mapping.dmp

Download
memory/1280-92-0x0000000000000000-mapping.dmp

Download
memory/1312-122-0x0000000000000000-mapping.dmp

Download
memory/1316-90-0x0000000000000000-mapping.dmp

Download
memory/1388-116-0x0000000000000000-mapping.dmp

Download
memory/1396-110-0x0000000000000000-mapping.dmp

Download
memory/1448-119-0x0000000000000000-mapping.dmp

Download
memory/1492-98-0x0000000000000000-mapping.dmp

Download
memory/1520-79-0x0000000000000000-mapping.dmp

Download
memory/1580-70-0x0000000000000000-mapping.dmp

Download
memory/1588-93-0x0000000000000000-mapping.dmp

Download
memory/1612-121-0x0000000000000000-mapping.dmp

Download
memory/1676-97-0x0000000000000000-mapping.dmp

Download
memory/1684-65-0x0000000000000000-mapping.dmp

Download
memory/1712-55-0x0000000000000000-mapping.dmp

Download
memory/1752-99-0x0000000000000000-mapping.dmp

Download
memory/1752-74-0x0000000000000000-mapping.dmp

Download
memory/1768-83-0x0000000000000000-mapping.dmp

Download
memory/1768-108-0x0000000000000000-mapping.dmp

Download
memory/1800-103-0x0000000000000000-mapping.dmp

Download
memory/1820-73-0x0000000000000000-mapping.dmp

Download
memory/1856-76-0x0000000000000000-mapping.dmp

Download
memory/1856-101-0x0000000000000000-mapping.dmp

Download
memory/1932-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Filesize
8KB

Download
memory/1940-109-0x0000000000000000-mapping.dmp

Download
memory/1960-66-0x0000000075361000-0x0000000075363000-memory.dmp

Filesize
8KB

Download
memory/1960-63-0x0000000000000000-mapping.dmp

Download
memory/1976-72-0x0000000000000000-mapping.dmp

Download
memory/1984-84-0x0000000000000000-mapping.dmp

Download
memory/1988-86-0x0000000000000000-mapping.dmp

Download
memory/2000-56-0x0000000000000000-mapping.dmp

Download
memory/2008-123-0x0000000000000000-mapping.dmp

Download
memory/2012-67-0x0000000000000000-mapping.dmp

Download
memory/2012-117-0x0000000000000000-mapping.dmp

Download
memory/2016-91-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads