Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe
Resource
win10v2004-20220812-en
General
-
Target
593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe
-
Size
480KB
-
MD5
6f50e2b491285314dffbdf495c20b1e0
-
SHA1
12f3bc625b8cde134da267ddbaa70df9ad49848b
-
SHA256
593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41
-
SHA512
ddd629e0c8136b3de43ed7a000caa268e3f65c6e6fe01eb3987cf848ea1841136fec129e49762ea2b6a48ffa87ee44a24d34c639fb8e4f75b47838cd4093edb0
-
SSDEEP
12288:R1DYr96WUZOMwO5eTV38FRCXUq89H8I/mVOQiXpuUUM:RdY5TMwseTvXUq89cYmQz5uUUM
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x0009000000022eb9-141.dat family_gh0strat behavioral2/files/0x0009000000022eb9-142.dat family_gh0strat -
joker
Joker is an Android malware that targets billing and SMS fraud.
-
resource yara_rule behavioral2/files/0x0006000000022f5c-134.dat aspack_v212_v242 behavioral2/files/0x0006000000022f5c-133.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 1616 ʵÃ÷ÈÏÖ¤.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ʵÃûË¢¿¨È«Äܸ¨Öú.exe -
Loads dropped DLL 1 IoCs
pid Process 3724 svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\xmwdfbfkpe svchost.exe File created C:\Windows\SysWOW64\xeijwxdmdj svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{73B172C1-428A-11ED-AECB-4A8324823CC0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\lbxywl.com\Total = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987927" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1224884776" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1224884776" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987927" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00be274f97d6d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\lbxywl.com\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1262541954" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987927" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987927" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.lbxywl.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987927" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1224884776" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987927" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\lbxywl.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mgy5.tv\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371504773" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1224884776" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987927" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1225041525" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1225041525" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987927" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1224884776" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum svchost.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} ʵÃûË¢¿¨È«Äܸ¨Öú.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell ʵÃûË¢¿¨È«Äܸ¨Öú.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage ʵÃûË¢¿¨È«Äܸ¨Öú.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command ʵÃûË¢¿¨È«Äܸ¨Öú.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID ʵÃûË¢¿¨È«Äܸ¨Öú.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3724 svchost.exe 3724 svchost.exe 3724 svchost.exe 3724 svchost.exe 3724 svchost.exe 3724 svchost.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeBackupPrivilege 1616 ʵÃ÷ÈÏÖ¤.exe Token: SeRestorePrivilege 1616 ʵÃ÷ÈÏÖ¤.exe Token: SeBackupPrivilege 1616 ʵÃ÷ÈÏÖ¤.exe Token: SeRestorePrivilege 1616 ʵÃ÷ÈÏÖ¤.exe Token: SeBackupPrivilege 3724 svchost.exe Token: SeRestorePrivilege 3724 svchost.exe Token: SeBackupPrivilege 3724 svchost.exe Token: SeBackupPrivilege 3724 svchost.exe Token: SeSecurityPrivilege 3724 svchost.exe Token: SeSecurityPrivilege 3724 svchost.exe Token: SeBackupPrivilege 3724 svchost.exe Token: SeBackupPrivilege 3724 svchost.exe Token: SeSecurityPrivilege 3724 svchost.exe Token: SeBackupPrivilege 3724 svchost.exe Token: SeBackupPrivilege 3724 svchost.exe Token: SeSecurityPrivilege 3724 svchost.exe Token: SeBackupPrivilege 3724 svchost.exe Token: SeRestorePrivilege 3724 svchost.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 5116 iexplore.exe 4028 iexplore.exe 1924 iexplore.exe 3564 iexplore.exe 3644 iexplore.exe 3760 iexplore.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 4028 iexplore.exe 4028 iexplore.exe 1924 iexplore.exe 1924 iexplore.exe 3760 iexplore.exe 3760 iexplore.exe 3644 iexplore.exe 3644 iexplore.exe 3564 iexplore.exe 3564 iexplore.exe 5116 iexplore.exe 5116 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2880 IEXPLORE.EXE 1184 IEXPLORE.EXE 2880 IEXPLORE.EXE 1184 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 756 IEXPLORE.EXE 756 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4768 wrote to memory of 4952 4768 593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe 82 PID 4768 wrote to memory of 4952 4768 593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe 82 PID 4768 wrote to memory of 4952 4768 593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe 82 PID 4768 wrote to memory of 1616 4768 593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe 83 PID 4768 wrote to memory of 1616 4768 593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe 83 PID 4768 wrote to memory of 1616 4768 593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe 83 PID 4952 wrote to memory of 4028 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 85 PID 4952 wrote to memory of 4028 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 85 PID 4952 wrote to memory of 1924 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 86 PID 4952 wrote to memory of 1924 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 86 PID 4952 wrote to memory of 5116 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 87 PID 4952 wrote to memory of 5116 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 87 PID 4952 wrote to memory of 3564 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 88 PID 4952 wrote to memory of 3564 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 88 PID 4952 wrote to memory of 3760 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 89 PID 4952 wrote to memory of 3760 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 89 PID 4952 wrote to memory of 3644 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 91 PID 4952 wrote to memory of 3644 4952 ʵÃûË¢¿¨È«Äܸ¨Öú.exe 91 PID 4028 wrote to memory of 2440 4028 iexplore.exe 97 PID 4028 wrote to memory of 2440 4028 iexplore.exe 97 PID 4028 wrote to memory of 2440 4028 iexplore.exe 97 PID 1924 wrote to memory of 3000 1924 iexplore.exe 92 PID 1924 wrote to memory of 3000 1924 iexplore.exe 92 PID 1924 wrote to memory of 3000 1924 iexplore.exe 92 PID 3760 wrote to memory of 3024 3760 iexplore.exe 96 PID 3760 wrote to memory of 3024 3760 iexplore.exe 96 PID 3760 wrote to memory of 3024 3760 iexplore.exe 96 PID 3644 wrote to memory of 2880 3644 iexplore.exe 95 PID 3644 wrote to memory of 2880 3644 iexplore.exe 95 PID 3644 wrote to memory of 2880 3644 iexplore.exe 95 PID 3564 wrote to memory of 756 3564 iexplore.exe 94 PID 3564 wrote to memory of 756 3564 iexplore.exe 94 PID 3564 wrote to memory of 756 3564 iexplore.exe 94 PID 5116 wrote to memory of 1184 5116 iexplore.exe 93 PID 5116 wrote to memory of 1184 5116 iexplore.exe 93 PID 5116 wrote to memory of 1184 5116 iexplore.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe"C:\Users\Admin\AppData\Local\Temp\593d9a97ac754168b88f27352eaaae8985c2a84d4031207d12d450b223d2fe41.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ʵÃûË¢¿¨È«Äܸ¨Öú.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ʵÃûË¢¿¨È«Äܸ¨Öú.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.lbxywl.com3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4028 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/1.asp3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/2.asp3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5116 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1184
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/3.asp3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3564 CREDAT:17410 /prefetch:24⤵
- Suspicious use of SetWindowsHookEx
PID:756
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/4.asp3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3760 CREDAT:17410 /prefetch:24⤵
- Suspicious use of SetWindowsHookEx
PID:3024
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" Http://wb.lbxywl.com/Ad/5.asp3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3644 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2880
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ʵÃ÷ÈÏÖ¤.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ʵÃ÷ÈÏÖ¤.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "netsvcs" -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD58656f34f3a7779daf590fdeb33617cd3
SHA1e84ea556aa2fe49cedbb88635ea1b3cb78f8a018
SHA25683b669f0f60eb7f66e726fedd126a651b1a977cde64d75dedbb9387cbc594f8d
SHA512e953b3c5906ae8599282a3cdfdaf792be80ba3e8ce25edd38192992617e22d39ce44a1fda74a7f2430bd7f65a391ece54546dbec19a6b314d1f53869a3e621f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5b28e5b4d9c66d91bcab8774316af12c4
SHA182105cce6fb037e186abe519029d8ca363555ec8
SHA25685a1474536815a9765e76f20455d2400531a2aa6345797ca2d5b52d86b368966
SHA51241a1bf8224aad3f262ea9077557ee556e0da0e7ae36ca16439712ee937be960f7df27687e5a01db811ae0d889415fd074e63811ae237729aa5f5365655c4aae9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5a2b2efe4ee769f57018c45e6b9f2781e
SHA1d1b95904cc6254e064272d73de58e95bab370403
SHA256ae325ff70bf267f7ae73a4371668125f385ccdab986e6c49fa97afbc06b2085c
SHA512cdfee64d7ca71715f7abd52ef009ca256e362e802867a6b1ca2d4148806d6461da5f0e8cd8f4e59c3c0fcc00076b267f8fa101e6b0821305c9acdc6e123edb21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5698a0b3503c68e9787e353951f246d0b
SHA190ed96bb20acfa75c263d65b0e073ee70a24a610
SHA256e9a092f8339a081bdc93e1319608d6b14e7f07ed7837e4fa81ebd2a6d18b1197
SHA5120b8fc0b12d8807636c93c74de744fd67838a8efc7bd9250610654c3a804c0077ae5557339ce01df67e8af5d82962405436568db1435dd76db7567bdb61d0cfd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5698a0b3503c68e9787e353951f246d0b
SHA190ed96bb20acfa75c263d65b0e073ee70a24a610
SHA256e9a092f8339a081bdc93e1319608d6b14e7f07ed7837e4fa81ebd2a6d18b1197
SHA5120b8fc0b12d8807636c93c74de744fd67838a8efc7bd9250610654c3a804c0077ae5557339ce01df67e8af5d82962405436568db1435dd76db7567bdb61d0cfd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5698a0b3503c68e9787e353951f246d0b
SHA190ed96bb20acfa75c263d65b0e073ee70a24a610
SHA256e9a092f8339a081bdc93e1319608d6b14e7f07ed7837e4fa81ebd2a6d18b1197
SHA5120b8fc0b12d8807636c93c74de744fd67838a8efc7bd9250610654c3a804c0077ae5557339ce01df67e8af5d82962405436568db1435dd76db7567bdb61d0cfd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD57279b3103b46ca5a00f9e18859cb172e
SHA17c2abf9e395fd287de07526925929b84da0e2fd2
SHA2568df4ba3a1f4099c01f7865e46554745574763a98a3af205d6b413b5f8697a97c
SHA512632d986452b74b72a0e076f64c327cb073b16aa4fc8e56d7509cd220b7e1de73f9c008fa8011b0699d86f10e693b78330ae8731078e959e143b52b28befde491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD57279b3103b46ca5a00f9e18859cb172e
SHA17c2abf9e395fd287de07526925929b84da0e2fd2
SHA2568df4ba3a1f4099c01f7865e46554745574763a98a3af205d6b413b5f8697a97c
SHA512632d986452b74b72a0e076f64c327cb073b16aa4fc8e56d7509cd220b7e1de73f9c008fa8011b0699d86f10e693b78330ae8731078e959e143b52b28befde491
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{73A8110E-428A-11ED-AECB-4A8324823CC0}.dat
Filesize4KB
MD56cc0675b917fdff6aaecccfe1b4ea814
SHA19fc0ef8a24ddfdc78c4094c10c4ebff9b38c2c3a
SHA256fc6eb9b824f8cf2a615271828200404768a3264c64e2f725c4637ca12ebc584d
SHA512ffca4d12e3b31136233fe6b0e2c001e07e6f298b2e01cf21ea6201a46691d038cd2fa798fdf1e4a4302fe0ee8abbf0465fceaf7cf4fee6b0ea5bc66ae2038c90
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{73AF5D98-428A-11ED-AECB-4A8324823CC0}.dat
Filesize4KB
MD59ed325ba101ec0342f9d4e5e9d7fa0a9
SHA11b6ea153c9ee549c99f8f7f708be80a4b326f0ee
SHA2563bda82648a0e8fcda3db6c125a45ec309fe2ed9a50a40977b7cabc73dfd1ece2
SHA51292c8932c5da72e8e5395e5430228e26f9241fe7d26f0c0c0596d48fa5099b4b9620b4cb111a576fa7cfc7cb3f171eb0f9e59f492b0c98f6ad6e41263be5f23cf
-
Filesize
1KB
MD54cce401ef2e6558b5ae3d7bb8df8c32a
SHA14910804f0ac3fafa3995d15c7574d3652c54df56
SHA2567ef800696ee66838d3d78a3242643804501693a8212d018ac442038b9e43b663
SHA5126ea6005f74a6544155609b79be8ee4f71e998604e1d2635320aebc49be6bb4c852c00345836d8dcb5b37c4cf783f248507ac76b49920260269aeecf1126378f4
-
Filesize
768KB
MD5f654b966fb49d9c94a7eb3344c8ac8c4
SHA1be33808cd3938d9eac87d3ad05c202b88b34f8fd
SHA25658a055b6a3126a43a6664567633c9b83f40106ac40464993d09a9c94c9c0f375
SHA512e803abdbce4f64b0bde940e15311bc00997894dfb675366d8688f39ee084ba9bdbb1176474491ec9cc700bb76b3afb5e9e97f69422e9e328e69168450c5eeb63
-
Filesize
192KB
MD587c4f6ec9a137bea1f00052b438417e3
SHA13cd79dc0b335feb011902805c69f75b0a73f6455
SHA2568bb2557b2a86bbf7b19a7ca20349e60726471151df575f4460d8608153632f19
SHA5121e5831bd17f03d7bc01e7863784f5ebfb13de7fc09eb63dc23957fc8e296159ff80f7ea936e4fc85ff4f1cfbd117f60803dec769fc3ce83a6e5191fbbfd75b47
-
Filesize
192KB
MD587c4f6ec9a137bea1f00052b438417e3
SHA13cd79dc0b335feb011902805c69f75b0a73f6455
SHA2568bb2557b2a86bbf7b19a7ca20349e60726471151df575f4460d8608153632f19
SHA5121e5831bd17f03d7bc01e7863784f5ebfb13de7fc09eb63dc23957fc8e296159ff80f7ea936e4fc85ff4f1cfbd117f60803dec769fc3ce83a6e5191fbbfd75b47
-
Filesize
287KB
MD5f8c6fa7133ee1e2bd1941e5d12e0a48f
SHA1797417d1e31f02b0ea0557b92300b3bd92a8be99
SHA2560862fb9a6e5292ab10ae4a08817da2e80da960840adb2ea4cd6feb5a2198207e
SHA512d84d50ba8c1e7acec14c419dd0669b259dac3e151558041be38936feab98b469401a3dc18cc0ad8d3833851157a9ddd16eb271f4ca5508ef34dacdc5b898ab04
-
Filesize
287KB
MD5f8c6fa7133ee1e2bd1941e5d12e0a48f
SHA1797417d1e31f02b0ea0557b92300b3bd92a8be99
SHA2560862fb9a6e5292ab10ae4a08817da2e80da960840adb2ea4cd6feb5a2198207e
SHA512d84d50ba8c1e7acec14c419dd0669b259dac3e151558041be38936feab98b469401a3dc18cc0ad8d3833851157a9ddd16eb271f4ca5508ef34dacdc5b898ab04
-
Filesize
768KB
MD5f654b966fb49d9c94a7eb3344c8ac8c4
SHA1be33808cd3938d9eac87d3ad05c202b88b34f8fd
SHA25658a055b6a3126a43a6664567633c9b83f40106ac40464993d09a9c94c9c0f375
SHA512e803abdbce4f64b0bde940e15311bc00997894dfb675366d8688f39ee084ba9bdbb1176474491ec9cc700bb76b3afb5e9e97f69422e9e328e69168450c5eeb63