Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 05:18
Static task
static1
Behavioral task
behavioral1
Sample
26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe
-
Size
212KB
-
MD5
f072cbe3aa6ec798d3d74db2a9a3e6a0
-
SHA1
a1329d247f94a92eceb5680367d9847ba031c1f2
-
SHA256
26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806
-
SHA512
3e48d68a96e5ac53f0bfc901f41d28f8aa4ce01fc673dcb2ccfd8831672a49bdb19171b8c5b6ce04be2090e44c8df8cdaab71ac246e7c206e4472436dd03c21d
-
SSDEEP
6144:qljASXqcAP6A5PACApvAPDyoAJMShfl4QxsYBO7Czn8DmJ:qJa+IGhflP
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 628 Program FilesJ36X4O.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\t.ico 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe File opened for modification \??\c:\Program Files\Common Files\d.ico 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E1430D1C-37FB-11ED-B696-F6DE28FD18F9} = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985224" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3213142689" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985224" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000fbd9226826060cf0fc8564a8b4eea9780b1c3936dfd7a0af1831210cdb8721a6000000000e8000000002000020000000683ed829de727eac53d93383c6035520a2c84908107f47a1e9cfee3db13f4843200000002ce0a6f83494ae96c3c3754b765580b3ca2d2c2b140a821488ff40b668cd859d4000000075b10f0b71165e8a63867debf964d81bbb5450c9ecb701a016941ff0e1287619ae51dcf87c86ad058e71ece67951b7522717171f759c5b3a01e14c49352709ed IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370344028" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701f21b908ccd801 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3213142689" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c52eb708ccd801 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000790e54c8acb79332a4dc88646e1eb0bd62fb2e61ad22975de1a2fc2463ba3f2a000000000e800000000200002000000086b65050912047e07b10d96d4d0b93d654948e221325d3d2819fe68b366bd27020000000be02181eaa4842f8d625679466a9c6bc3d54a8b493c28de0bf9eec62c554ad004000000092a1e8905926dfaff54411f0510fbcb029a5d4252e22b93761274b99693503bb682d0f80c4abf402178a7f548f3f60bebf2d01adffe5fddb469ccfdbdf02c029 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\ 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?2012" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\ 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?2012" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.5ijunshi.com/?2012" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htb 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\ 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\ 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\ 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?2012" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.h35 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?2012" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hli 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\ 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?2012" 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 856 IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 856 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3560 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe 628 Program FilesJ36X4O.exe 856 IEXPLORE.exe 856 IEXPLORE.exe 4996 IEXPLORE.EXE 4996 IEXPLORE.EXE 4996 IEXPLORE.EXE 4996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3560 wrote to memory of 628 3560 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe 82 PID 3560 wrote to memory of 628 3560 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe 82 PID 3560 wrote to memory of 628 3560 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe 82 PID 628 wrote to memory of 856 628 Program FilesJ36X4O.exe 84 PID 628 wrote to memory of 856 628 Program FilesJ36X4O.exe 84 PID 856 wrote to memory of 4996 856 IEXPLORE.exe 85 PID 856 wrote to memory of 4996 856 IEXPLORE.exe 85 PID 856 wrote to memory of 4996 856 IEXPLORE.exe 85 PID 628 wrote to memory of 5008 628 Program FilesJ36X4O.exe 86 PID 628 wrote to memory of 5008 628 Program FilesJ36X4O.exe 86 PID 3560 wrote to memory of 4868 3560 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe 87 PID 3560 wrote to memory of 4868 3560 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe 87 PID 3560 wrote to memory of 4868 3560 26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe"C:\Users\Admin\AppData\Local\Temp\26dfe977ecf5028d3e001a7cc86be5ed4caa4ec5274b88854d21a93fe56e4806.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\Program FilesJ36X4O.exe"c:\Program FilesJ36X4O.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.nyni.info:1287/CPAdown/vplay.php3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4996
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.nyni.info:1287/CPAdown/PPTV(pplive)_forjieku_977.html3⤵
- Modifies Internet Explorer settings
PID:5008
-
-
-
C:\Windows\SysWOW64\WScript.ExeWScript.Exe jies.bak.vbs2⤵PID:4868
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD57e82574b74e97688782ba6c2f1371736
SHA1f22de6923db2939157a10d508013f755b4551840
SHA256ac732cb694e7a0983da7ffeaa6e78d55053ef4380007eaea47bb35aa35819853
SHA512eb746112be466a6d5a04d9b9732709e238d9edb3e027afc7183fe959dc7b79a415e50ddefb28c40a1d52125576a0fea83e15082d8a1d677fea009bb780a8f37d
-
Filesize
486B
MD5ce454be99ea889cd057525701dcfa3ed
SHA1a599baf0b858d5c920a2037d3de7744045113b08
SHA256f70634c7c8096612dbc52c81a40a58782fe9749263fa4935990f43081e47f67b
SHA512872604bb5349c6816d7cc89564976fa21f3dbc03e77686828ea397e3c4208efbc3af7ba0b5d1fda1353c766512c326308de62a73d0621d79ed8788321be987a5
-
Filesize
36KB
MD57e82574b74e97688782ba6c2f1371736
SHA1f22de6923db2939157a10d508013f755b4551840
SHA256ac732cb694e7a0983da7ffeaa6e78d55053ef4380007eaea47bb35aa35819853
SHA512eb746112be466a6d5a04d9b9732709e238d9edb3e027afc7183fe959dc7b79a415e50ddefb28c40a1d52125576a0fea83e15082d8a1d677fea009bb780a8f37d