f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc

General

Target

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Size

978KB
MD5

0a57cf93855798d5c2e7d73e3e246273
SHA1

be46616f832c6af9f3d148ca9627e50cf99d18a4
SHA256

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc
SHA512

482aa50e50a901c48485d34e97a8b8fc05e0ff996c13a53182e692a6b710da8d060b69c8eede09a9471797417c30a55f600d76a063082623d159c3e6ad663ec4

Score

10^/10

adware evasion persistence stealer upx

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\ = "管理员取得所有权"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\Command\ = "cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"	regedit.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Executes dropped EXE 1 IoCs

Processes:

WIN7服务.exe

pid process

4080 WIN7服务.exe

pid	process
4080	WIN7服务.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe	upx
C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WIN7服务.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	WIN7服务.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run	regedit.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disabling Security Tools
T1089

Modify Registry
T1112

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

regedit.exef7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IEWatsonEnabled = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Groups = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\DEPOff = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "2"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RunOnceHasShown = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\TabbedBrowsing	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RunOnceComplete = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ThumbnailBehavior = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "2"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ThumbnailBehavior = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "2"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "2"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Groups = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1"	regedit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.hao839.com/"	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\ScreenSaveActive = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\SCRNSAVE.EXE	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "2"	regedit.exe

Modifies registry class 64 IoCs

Processes:

regedit.exef7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\Reg	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\Reg\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\runas\ = "管理员取得所有权"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ = "Internet Explorer"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\NoAddOns\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\UnReg	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Dezinstall	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\Command\ = "cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\runas\Command\ = "cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\解压缩 CAB 文件\command\ = "expand -r \"%1\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\DevMgr\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\服务管理\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\HideFolderVerbs	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\UnReg	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe,-32528"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\解压缩 CAB 文件\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\runas\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Open\ = "打开主页(&H)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\WantsParseDisplayName	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Reg\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\Reg\ = "Register OCX"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\runas\Command\ = "cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\组策略对象编辑器\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Open\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Reg	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\解压缩 CAB 文件	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\DevMgr	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\NoAddOns	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Set\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\HideOnDesktopPerUser	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\UnReg\Command\ = "regsvr32 /u %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{889D2FEB-5411-4565-8998-1DD2C5261283}\InprocServer32	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Dezinstall\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Set\ = "属性(&R)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\UnReg\Command\ = "regsvr32 /u %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\runas\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\CAB最大压缩\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\组策略对象编辑器	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Reg\Command\ = "regsvr32 %1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\UnReg\ = "UnRegister OCX"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\runas\ = "管理员取得所有权"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\CAB最大压缩	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\控制面板	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\Shell\Set\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\Reg\Command\ = "regsvr32 %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{889D2FEB-5411-4565-8998-1DD2C5261283}	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\TakeAuthority\ = "管理员取得所有权"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\runas	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\CAB最大压缩\command\ = "makecab /v3 /D CompressionType=LZX /D CompressionMemory=21 \"%1\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\控制面板\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B416D21B-3B22-B6D4-BBD3-BBD452DB3D5B}\ShellFolder\HideAsDeletePerUser	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\UnReg\ = "UnRegister DLL "	regedit.exe

NTFS ADS 1 IoCs

Processes:

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

220 regedit.exe
4340 regedit.exe

pid	process
220	regedit.exe
4340	regedit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powercfg.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	2824	powercfg.exe
Token: SeCreatePagefilePrivilege	2824	powercfg.exe
Token: SeShutdownPrivilege	2632	powercfg.exe
Token: SeCreatePagefilePrivilege	2632	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.execmd.execmd.execmd.execmd.exeWIN7服务.execmd.exe

description	pid	process	target process
PID 4736 wrote to memory of 2880	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 4736 wrote to memory of 2880	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 2880 wrote to memory of 220	2880	cmd.exe	regedit.exe
PID 2880 wrote to memory of 220	2880	cmd.exe	regedit.exe
PID 4736 wrote to memory of 4664	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 4736 wrote to memory of 4664	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 4664 wrote to memory of 4340	4664	cmd.exe	regedit.exe
PID 4664 wrote to memory of 4340	4664	cmd.exe	regedit.exe
PID 4736 wrote to memory of 4080	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	WIN7服务.exe
PID 4736 wrote to memory of 4080	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	WIN7服务.exe
PID 4736 wrote to memory of 4080	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	WIN7服务.exe
PID 4736 wrote to memory of 4088	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 4736 wrote to memory of 4088	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 4088 wrote to memory of 2824	4088	cmd.exe	powercfg.exe
PID 4088 wrote to memory of 2824	4088	cmd.exe	powercfg.exe
PID 4736 wrote to memory of 1440	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 4736 wrote to memory of 1440	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 1440 wrote to memory of 2632	1440	cmd.exe	powercfg.exe
PID 1440 wrote to memory of 2632	1440	cmd.exe	powercfg.exe
PID 4736 wrote to memory of 2588	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 4736 wrote to memory of 2588	4736	f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe	cmd.exe
PID 4080 wrote to memory of 3468	4080	WIN7服务.exe	cmd.exe
PID 4080 wrote to memory of 3468	4080	WIN7服务.exe	cmd.exe
PID 4080 wrote to memory of 3468	4080	WIN7服务.exe	cmd.exe
PID 3468 wrote to memory of 604	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 604	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 604	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1900	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1900	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1900	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1852	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1852	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1852	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1932	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1932	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1932	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4800	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4800	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4800	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1068	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1068	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1068	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 2500	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 2500	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 2500	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4740	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4740	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4740	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 3140	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 3140	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 3140	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1720	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1720	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 1720	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 5104	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 5104	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 5104	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 3356	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 3356	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 3356	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4128	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4128	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 4128	3468	cmd.exe	sc.exe
PID 3468 wrote to memory of 2752	3468	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe
"C:\Users\Admin\AppData\Local\Temp\f7d19b967d8d5c4430f1f07b8e8012b7e4350a36e98d0f76b672c0227d5e37cc.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c regedit /s "C:\Users\Admin\AppData\Local\Temp\WIN7优化.reg"
2⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\regedit.exe
regedit /s "C:\Users\Admin\AppData\Local\Temp\WIN7优化.reg"
3⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Runs .reg file with regedit
PID:220

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c regedit /s "C:\Users\Admin\AppData\Local\Temp\WIN7优化2.reg"
2⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\regedit.exe
regedit /s "C:\Users\Admin\AppData\Local\Temp\WIN7优化2.reg"
3⤵
- Runs .reg file with regedit
PID:4340

C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe
C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E00F.tmp\Win7·þÎñ.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\sc.exe
sc config AeLookupSvc start= DEMAND
4⤵
PID:604

C:\Windows\SysWOW64\sc.exe
sc config ALG start= DEMAND
4⤵
PID:1900

C:\Windows\SysWOW64\sc.exe
sc config AppIDSvc start= DEMAND
4⤵
PID:1852

C:\Windows\SysWOW64\sc.exe
sc config Appinfo start= DEMAND
4⤵
PID:1932

C:\Windows\SysWOW64\sc.exe
sc config AppMgmt start= DEMAND
4⤵
PID:4800

C:\Windows\SysWOW64\sc.exe
sc config AudioEndpointBuilder start= AUTO
4⤵
PID:1068

C:\Windows\SysWOW64\sc.exe
sc config Audiosrv start= AUTO
4⤵
PID:2500

C:\Windows\SysWOW64\sc.exe
sc config AxInstSV start= DEMAND
4⤵
PID:4740

C:\Windows\SysWOW64\sc.exe
sc config BDESVC start= DEMAND
4⤵
PID:3140

C:\Windows\SysWOW64\sc.exe
sc config BFE start= AUTO
4⤵
PID:1720

C:\Windows\SysWOW64\sc.exe
sc config BITS start= AUTO
4⤵
PID:5104

C:\Windows\SysWOW64\sc.exe
sc config Browser start= DEMAND
4⤵
PID:3356

C:\Windows\SysWOW64\sc.exe
sc config bthserv start= DEMAND
4⤵
PID:4128

C:\Windows\SysWOW64\sc.exe
sc config CertPropSvc start= DEMAND
4⤵
PID:2752

C:\Windows\SysWOW64\sc.exe
sc config clr_optimization_v2.0.50727_32 start= DEMAND
4⤵
PID:3692

C:\Windows\SysWOW64\sc.exe
sc config COMSysApp start= DEMAND
4⤵
PID:3156

C:\Windows\SysWOW64\sc.exe
sc config CryptSvc start= AUTO
4⤵
PID:3780

C:\Windows\SysWOW64\sc.exe
sc config CscService start= DISABLED
4⤵
PID:3704

C:\Windows\SysWOW64\sc.exe
sc config DcomLaunch start= AUTO
4⤵
PID:208

C:\Windows\SysWOW64\sc.exe
sc config defragsvc start= DEMAND
4⤵
PID:212

C:\Windows\SysWOW64\sc.exe
sc config Dhcp start= AUTO
4⤵
PID:536

C:\Windows\SysWOW64\sc.exe
sc config Dnscache start= AUTO
4⤵
PID:1588

C:\Windows\SysWOW64\sc.exe
sc config dot3svc start= DEMAND
4⤵
PID:4372

C:\Windows\SysWOW64\sc.exe
sc config DPS start= DISABLED
4⤵
PID:3100

C:\Windows\SysWOW64\sc.exe
sc config EapHost start= DEMAND
4⤵
PID:3528

C:\Windows\SysWOW64\sc.exe
sc config EFS start= DEMAND
4⤵
PID:3348

C:\Windows\SysWOW64\sc.exe
sc config ehRecvr start= DISABLED
4⤵
PID:1240

C:\Windows\SysWOW64\sc.exe
sc config ehSched start= DEMAND
4⤵
PID:1912

C:\Windows\SysWOW64\sc.exe
sc config eventlog start= AUTO
4⤵
PID:3876

C:\Windows\SysWOW64\sc.exe
sc config EventSystem start= AUTO
4⤵
PID:3264

C:\Windows\SysWOW64\sc.exe
sc config Fax start= DISABLED
4⤵
PID:2924

C:\Windows\SysWOW64\sc.exe
sc config fdPHost start= DEMAND
4⤵
PID:4064

C:\Windows\SysWOW64\sc.exe
sc config FDResPub start= DEMAND
4⤵
PID:5052

C:\Windows\SysWOW64\sc.exe
sc config FontCache start= AUTO
4⤵
PID:924

C:\Windows\SysWOW64\sc.exe
sc config FontCache3.0.0.0 start= DEMAND
4⤵
PID:3116

C:\Windows\SysWOW64\sc.exe
sc config gpsvc start= AUTO
4⤵
PID:2472

C:\Windows\SysWOW64\sc.exe
sc config hidserv start= DEMAND
4⤵
PID:2456

C:\Windows\SysWOW64\sc.exe
sc config hkmsvc start= DEMAND
4⤵
PID:3132

C:\Windows\SysWOW64\sc.exe
sc config HomeGroupListener start= DEMAND
4⤵
PID:2220

C:\Windows\SysWOW64\sc.exe
sc config HomeGroupProvider start= DEMAND
4⤵
PID:4288

C:\Windows\SysWOW64\sc.exe
sc config idsvc start= DEMAND
4⤵
PID:1404

C:\Windows\SysWOW64\sc.exe
sc config IKEEXT start= AUTO
4⤵
PID:2364

C:\Windows\SysWOW64\sc.exe
sc config IPBusEnum start= DEMAND
4⤵
PID:1800

C:\Windows\SysWOW64\sc.exe
sc config iphlpsvc start= DEMAND
4⤵
PID:4968

C:\Windows\SysWOW64\sc.exe
sc config KeyIso start= DEMAND
4⤵
PID:444

C:\Windows\SysWOW64\sc.exe
sc config KtmRm start= DISABLED
4⤵
PID:1784

C:\Windows\SysWOW64\sc.exe
sc config LanmanServer start= AUTO
4⤵
PID:1372

C:\Windows\SysWOW64\sc.exe
sc config LanmanWorkstation start= AUTO
4⤵
PID:4420

C:\Windows\SysWOW64\sc.exe
sc config lltdsvc start= DEMAND
4⤵
PID:1356

C:\Windows\SysWOW64\sc.exe
sc config lmhosts start= AUTO
4⤵
PID:3508

C:\Windows\SysWOW64\sc.exe
sc config Mcx2Svc start= DISABLED
4⤵
PID:3044

C:\Windows\SysWOW64\sc.exe
sc config MMCSS start= AUTO
4⤵
PID:5044

C:\Windows\SysWOW64\sc.exe
sc config MpsSvc start= DEMAND
4⤵
PID:4488

C:\Windows\SysWOW64\sc.exe
sc config MSDTC start= DEMAND
4⤵
PID:1888

C:\Windows\SysWOW64\sc.exe
sc config MSiSCSI start= DEMAND
4⤵
PID:1576

C:\Windows\SysWOW64\sc.exe
sc config msiserver start= DEMAND
4⤵
PID:3760

C:\Windows\SysWOW64\sc.exe
sc config napagent start= DEMAND
4⤵
PID:1644

C:\Windows\SysWOW64\sc.exe
sc config Netlogon start= DEMAND
4⤵
PID:3984

C:\Windows\SysWOW64\sc.exe
sc config Netman start= DEMAND
4⤵
PID:1520

C:\Windows\SysWOW64\sc.exe
sc config netprofm start= DEMAND
4⤵
PID:1340

C:\Windows\SysWOW64\sc.exe
sc config NetTcpPortSharing start= DISABLED
4⤵
PID:1876

C:\Windows\SysWOW64\sc.exe
sc config NlaSvc start= AUTO
4⤵
PID:2368

C:\Windows\SysWOW64\sc.exe
sc config nsi start= AUTO
4⤵
PID:1168

C:\Windows\SysWOW64\sc.exe
sc config p2pimsvc start= DEMAND
4⤵
PID:944

C:\Windows\SysWOW64\sc.exe
sc config p2psvc start= DEMAND
4⤵
PID:4396

C:\Windows\SysWOW64\sc.exe
sc config PcaSvc start= DISABLED
4⤵
PID:1956

C:\Windows\SysWOW64\sc.exe
sc config PeerDistSvc start= DEMAND
4⤵
PID:1412

C:\Windows\SysWOW64\sc.exe
sc config pla start= DEMAND
4⤵
PID:3860

C:\Windows\SysWOW64\sc.exe
sc config PlugPlay start= AUTO
4⤵
PID:4988

C:\Windows\SysWOW64\sc.exe
sc config PNRPAutoReg start= DEMAND
4⤵
PID:5012

C:\Windows\SysWOW64\sc.exe
sc config PNRPsvc start= DEMAND
4⤵
PID:396

C:\Windows\SysWOW64\sc.exe
sc config PolicyAgent start= DEMAND
4⤵
PID:1328

C:\Windows\SysWOW64\sc.exe
sc config Power start= AUTO
4⤵
PID:3552

C:\Windows\SysWOW64\sc.exe
sc config ProfSvc start= AUTO
4⤵
PID:2380

C:\Windows\SysWOW64\sc.exe
sc config ProtectedStorage start= DEMAND
4⤵
PID:3676

C:\Windows\SysWOW64\sc.exe
sc config QWAVE start= DEMAND
4⤵
PID:3388

C:\Windows\SysWOW64\sc.exe
sc config RasAuto start= DEMAND
4⤵
PID:4484

C:\Windows\SysWOW64\sc.exe
sc config RasMan start= DEMAND
4⤵
PID:4476

C:\Windows\SysWOW64\sc.exe
sc config RemoteAccess start= DISABLED
4⤵
PID:1900

C:\Windows\SysWOW64\sc.exe
sc config RemoteRegistry start= DISABLED
4⤵
PID:4232

C:\Windows\SysWOW64\sc.exe
sc config RpcEptMapper start= AUTO
4⤵
PID:1932

C:\Windows\SysWOW64\sc.exe
sc config RpcLocator start= DEMAND
4⤵
PID:2524

C:\Windows\SysWOW64\sc.exe
sc config RpcSs start= AUTO
4⤵
PID:1284

C:\Windows\SysWOW64\sc.exe
sc config SamSs start= AUTO
4⤵
PID:4344

C:\Windows\SysWOW64\sc.exe
sc config SCardSvr start= DEMAND
4⤵
PID:1204

C:\Windows\SysWOW64\sc.exe
sc config Schedule start= AUTO
4⤵
PID:4316

C:\Windows\SysWOW64\sc.exe
sc config SCPolicySvc start= DISABLED
4⤵
PID:4740

C:\Windows\SysWOW64\sc.exe
sc config SDRSVC start= DEMAND
4⤵
PID:1712

C:\Windows\SysWOW64\sc.exe
sc config seclogon start= DISABLED
4⤵
PID:4872

C:\Windows\SysWOW64\sc.exe
sc config SENS start= AUTO
4⤵
PID:1148

C:\Windows\SysWOW64\sc.exe
sc config SensrSvc start= DEMAND
4⤵
PID:4764

C:\Windows\SysWOW64\sc.exe
sc config SessionEnv start= DEMAND
4⤵
PID:3684

C:\Windows\SysWOW64\sc.exe
sc config SharedAccess start= DISABLED
4⤵
PID:2180

C:\Windows\SysWOW64\sc.exe
sc config ShellHWDetection start= DEMAND
4⤵
PID:4128

C:\Windows\SysWOW64\sc.exe
sc config SNMPTRAP start= DISABLED
4⤵
PID:3688

C:\Windows\SysWOW64\sc.exe
sc config Spooler start= AUTO
4⤵
PID:4856

C:\Windows\SysWOW64\sc.exe
sc config sppsvc start= AUTO
4⤵
PID:3692

C:\Windows\SysWOW64\sc.exe
sc config sppuinotify start= DEMAND
4⤵
PID:2308

C:\Windows\SysWOW64\sc.exe
sc config SSDPSRV start= DEMAND
4⤵
PID:1908

C:\Windows\SysWOW64\sc.exe
sc config SstpSvc start= DEMAND
4⤵
PID:224

C:\Windows\SysWOW64\sc.exe
sc config StiSvc start= DEMAND
4⤵
PID:216

C:\Windows\SysWOW64\sc.exe
sc config swprv start= DEMAND
4⤵
PID:4416

C:\Windows\SysWOW64\sc.exe
sc config SysMain start= AUTO
4⤵
PID:2724

C:\Windows\SysWOW64\sc.exe
sc config TabletInputService start= DEMAND
4⤵
PID:212

C:\Windows\SysWOW64\sc.exe
sc config TapiSrv start= DEMAND
4⤵
PID:536

C:\Windows\SysWOW64\sc.exe
sc config TBS start= DEMAND
4⤵
PID:1952

C:\Windows\SysWOW64\sc.exe
sc config TermService start= DEMAND
4⤵
PID:4948

C:\Windows\SysWOW64\sc.exe
sc config Themes start= AUTO
4⤵
PID:3084

C:\Windows\SysWOW64\sc.exe
sc config THREADORDER start= DEMAND
4⤵
PID:3332

C:\Windows\SysWOW64\sc.exe
sc config TrkWks start= DISABLED
4⤵
PID:1008

C:\Windows\SysWOW64\sc.exe
sc config TrustedInstaller start= DEMAND
4⤵
PID:3528

C:\Windows\SysWOW64\sc.exe
sc config UI0Detect start= DEMAND
4⤵
PID:5116

C:\Windows\SysWOW64\sc.exe
sc config UmRdpService start= DEMAND
4⤵
PID:520

C:\Windows\SysWOW64\sc.exe
sc config upnphost start= DEMAND
4⤵
PID:3360

C:\Windows\SysWOW64\sc.exe
sc config UxSms start= AUTO
4⤵
PID:1912

C:\Windows\SysWOW64\sc.exe
sc config VaultSvc start= DEMAND
4⤵
PID:2260

C:\Windows\SysWOW64\sc.exe
sc config vds start= DEMAND
4⤵
PID:1056

C:\Windows\SysWOW64\sc.exe
sc config VSS start= DEMAND
4⤵
PID:4512

C:\Windows\SysWOW64\sc.exe
sc config W32Time start= DEMAND
4⤵
PID:2924

C:\Windows\SysWOW64\sc.exe
sc config wbengine start= DEMAND
4⤵
PID:5016

C:\Windows\SysWOW64\sc.exe
sc config WbioSrvc start= DEMAND
4⤵
PID:2304

C:\Windows\SysWOW64\sc.exe
sc config wcncsvc start= DEMAND
4⤵
PID:2632

C:\Windows\SysWOW64\sc.exe
sc config WcsPlugInService start= DEMAND
4⤵
PID:3116

C:\Windows\SysWOW64\sc.exe
sc config WdiServiceHost start= DISABLED
4⤵
PID:1440

C:\Windows\SysWOW64\sc.exe
sc config WdiSystemHost start= DISABLED
4⤵
PID:1076

C:\Windows\SysWOW64\sc.exe
sc config WebClient start= DEMAND
4⤵
PID:2456

C:\Windows\SysWOW64\sc.exe
sc config Wecsvc start= DEMAND
4⤵
PID:4860

C:\Windows\SysWOW64\sc.exe
sc config wercplsupport start= DISABLED
4⤵
PID:2608

C:\Windows\SysWOW64\sc.exe
sc config WerSvc start= DISABLED
4⤵
PID:2220

C:\Windows\SysWOW64\sc.exe
sc config WinDefend start= DEMAND
4⤵
PID:1296

C:\Windows\SysWOW64\sc.exe
sc config WinHttpAutoProxySvc start= DEMAND
4⤵
PID:4060

C:\Windows\SysWOW64\sc.exe
sc config Winmgmt start= AUTO
4⤵
PID:1404

C:\Windows\SysWOW64\sc.exe
sc config WinRM start= DISABLED
4⤵
PID:3420

C:\Windows\SysWOW64\sc.exe
sc config Wlansvc start= DEMAND
4⤵
PID:2320

C:\Windows\SysWOW64\sc.exe
sc config wmiApSrv start= DEMAND
4⤵
PID:3648

C:\Windows\SysWOW64\sc.exe
sc config WMPNetworkSvc start= DEMAND
4⤵
PID:4124

C:\Windows\SysWOW64\sc.exe
sc config WPCSvc start= DISABLED
4⤵
PID:2592

C:\Windows\SysWOW64\sc.exe
sc config WPDBusEnum start= DEMAND
4⤵
PID:444

C:\Windows\SysWOW64\sc.exe
sc config wscsvc start= DEMAND
4⤵
PID:3732

C:\Windows\SysWOW64\sc.exe
sc config WSearch start= DISABLED
4⤵
PID:3424

C:\Windows\SysWOW64\sc.exe
sc config wuauserv start= AUTO
4⤵
PID:1372

C:\Windows\SysWOW64\sc.exe
sc config wudfsvc start= DEMAND
4⤵
PID:4420

C:\Windows\SysWOW64\sc.exe
sc config WwanSvc start= DEMAND
4⤵
PID:2528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powercfg -change -monitor-timeout-ac 15
2⤵
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\system32\powercfg.exe
powercfg -change -monitor-timeout-ac 15
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powercfg -change -standby-timeout-ac 0
2⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\system32\powercfg.exe
powercfg -change -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c del /f /s /q %windir%\*.bak
2⤵
PID:2588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

2

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

6

T1112

Disabling Security Tools

1

T1089

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E00F.tmp\Win7·þÎñ.bat
Filesize
5KB

MD5
49efc4c8ac66c2abce02c89024c2d706

SHA1
bac073d6839819f7e492a651e28ddeaef13d3c52

SHA256
2669563af2fd6f7519db936a899ed3fd431214f7742b855db702d5e74b32c34e

SHA512
828e9ccaca818174ffd6f9ae9fe933eb84fbbbef1556fc73bca8d0a71b01d57cc443ba8e54b048d4859b37bdafd5e0bd6d8a807972b349dfefff94f0734734b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WIN7优化.reg
Filesize
32KB

MD5
fd27cb1190fbd22a8ab0aeb5571ae411

SHA1
c856be5e2d203b6057fde26690c5c25b4c7fc39d

SHA256
792e23f946a93b8d444e55b7ba59246000daa39293f557388883d40491edfeb6

SHA512
2bf3d39f80ed1dc79869dd3e0bdaa7aed92c204e4c9ca963584be9c6c3acf7127a2c7aaf39e4cddf1d4798e5f29f5b993c57d0f32e32e143f93ae98ab4848265

Download Submit
C:\Users\Admin\AppData\Local\Temp\WIN7优化2.reg
Filesize
974B

MD5
8fc60d0f06d32a7949710c6a1a1de036

SHA1
19f8e1f33fef6681cf56d783dc02c92421978b66

SHA256
411161d4a4cf5dc07f9eb2398c31fbb83bf5b7f76d2bd9dced759719f12c36fa

SHA512
e96596701c612fe54d711c0408b8461f1b665b2f6a1a7a5ee9d1d3dbc24c1bcb8434b0def86c3701f9540b7597cb8905d4aee1b0b55d4fabad0d8bfff8d5a8df

Download Submit
C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe
Filesize
31KB

MD5
25e6a394a01e13ed75c5cae03eb63a23

SHA1
9d88f80e6db01fc8fcaf0518976706e1f6a94e0d

SHA256
49f7526676569f75456d41ad027bc2cd687b6f03aac1f74565d05b6a7f771e4a

SHA512
f053fe79dcc7383c43260c1a3820a9ed47ff51872ed053943d1b8c7be3fa9f1ce983fba4da2c8a2abcd8f6eecb390c6c6020993b5ecea7dbf035e59f6548fc18

Download Submit
C:\Users\Admin\AppData\Local\Temp\WIN7服务.exe
Filesize
31KB

MD5
25e6a394a01e13ed75c5cae03eb63a23

SHA1
9d88f80e6db01fc8fcaf0518976706e1f6a94e0d

SHA256
49f7526676569f75456d41ad027bc2cd687b6f03aac1f74565d05b6a7f771e4a

SHA512
f053fe79dcc7383c43260c1a3820a9ed47ff51872ed053943d1b8c7be3fa9f1ce983fba4da2c8a2abcd8f6eecb390c6c6020993b5ecea7dbf035e59f6548fc18

Download Submit
memory/208-164-0x0000000000000000-mapping.dmp

Download
memory/212-165-0x0000000000000000-mapping.dmp

Download
memory/220-131-0x0000000000000000-mapping.dmp

Download
memory/444-190-0x0000000000000000-mapping.dmp

Download
memory/536-166-0x0000000000000000-mapping.dmp

Download
memory/604-146-0x0000000000000000-mapping.dmp

Download
memory/924-179-0x0000000000000000-mapping.dmp

Download
memory/1068-151-0x0000000000000000-mapping.dmp

Download
memory/1240-172-0x0000000000000000-mapping.dmp

Download
memory/1356-194-0x0000000000000000-mapping.dmp

Download
memory/1372-192-0x0000000000000000-mapping.dmp

Download
memory/1404-186-0x0000000000000000-mapping.dmp

Download
memory/1440-140-0x0000000000000000-mapping.dmp

Download
memory/1588-167-0x0000000000000000-mapping.dmp

Download
memory/1720-155-0x0000000000000000-mapping.dmp

Download
memory/1784-191-0x0000000000000000-mapping.dmp

Download
memory/1800-188-0x0000000000000000-mapping.dmp

Download
memory/1852-148-0x0000000000000000-mapping.dmp

Download
memory/1900-147-0x0000000000000000-mapping.dmp

Download
memory/1912-173-0x0000000000000000-mapping.dmp

Download
memory/1932-149-0x0000000000000000-mapping.dmp

Download
memory/2220-184-0x0000000000000000-mapping.dmp

Download
memory/2364-187-0x0000000000000000-mapping.dmp

Download
memory/2456-182-0x0000000000000000-mapping.dmp

Download
memory/2472-181-0x0000000000000000-mapping.dmp

Download
memory/2500-152-0x0000000000000000-mapping.dmp

Download
memory/2588-143-0x0000000000000000-mapping.dmp

Download
memory/2632-141-0x0000000000000000-mapping.dmp

Download
memory/2752-159-0x0000000000000000-mapping.dmp

Download
memory/2824-139-0x0000000000000000-mapping.dmp

Download
memory/2880-130-0x0000000000000000-mapping.dmp

Download
memory/2924-176-0x0000000000000000-mapping.dmp

Download
memory/3044-196-0x0000000000000000-mapping.dmp

Download
memory/3100-169-0x0000000000000000-mapping.dmp

Download
memory/3116-180-0x0000000000000000-mapping.dmp

Download
memory/3132-183-0x0000000000000000-mapping.dmp

Download
memory/3140-154-0x0000000000000000-mapping.dmp

Download
memory/3156-161-0x0000000000000000-mapping.dmp

Download
memory/3264-175-0x0000000000000000-mapping.dmp

Download
memory/3348-171-0x0000000000000000-mapping.dmp

Download
memory/3356-157-0x0000000000000000-mapping.dmp

Download
memory/3468-144-0x0000000000000000-mapping.dmp

Download
memory/3508-195-0x0000000000000000-mapping.dmp

Download
memory/3528-170-0x0000000000000000-mapping.dmp

Download
memory/3692-160-0x0000000000000000-mapping.dmp

Download
memory/3704-163-0x0000000000000000-mapping.dmp

Download
memory/3780-162-0x0000000000000000-mapping.dmp

Download
memory/3876-174-0x0000000000000000-mapping.dmp

Download
memory/4064-177-0x0000000000000000-mapping.dmp

Download
memory/4080-136-0x0000000000000000-mapping.dmp

Download
memory/4088-138-0x0000000000000000-mapping.dmp

Download
memory/4128-158-0x0000000000000000-mapping.dmp

Download
memory/4288-185-0x0000000000000000-mapping.dmp

Download
memory/4340-134-0x0000000000000000-mapping.dmp

Download
memory/4372-168-0x0000000000000000-mapping.dmp

Download
memory/4420-193-0x0000000000000000-mapping.dmp

Download
memory/4488-198-0x0000000000000000-mapping.dmp

Download
memory/4664-133-0x0000000000000000-mapping.dmp

Download
memory/4740-153-0x0000000000000000-mapping.dmp

Download
memory/4800-150-0x0000000000000000-mapping.dmp

Download
memory/4968-189-0x0000000000000000-mapping.dmp

Download
memory/5044-197-0x0000000000000000-mapping.dmp

Download
memory/5052-178-0x0000000000000000-mapping.dmp

Download
memory/5104-156-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads