Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe
Resource
win10v2004-20220901-en
General
-
Target
79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe
-
Size
37KB
-
MD5
63fa1704b4bbeda36f9a1d254fae9166
-
SHA1
a4a8f7bc74334a548e6055b7ac82459ec6892dd3
-
SHA256
79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
-
SHA512
e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
SSDEEP
768:8HrZtjEF/e782hCY4g/iB0F79KIDN1dCvbYLYQV5nCsm:+rZtaewPBaF79KuUbYLK
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" Hole.zip Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, \"C:\\Windows\\system32\\M5VBVM60.EXE StartUp\"" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, \"C:\\Windows\\system32\\M5VBVM60.EXE StartUp\"" Zero.txt -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\SysWow64\\rund1132.exe %1" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\SysWow64\\rund1132.exe %1" Zero.txt -
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Zero.txt -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Zero.txt -
Executes dropped EXE 5 IoCs
pid Process 3480 Empty.jpg 3004 Blank.doc 3616 Zero.txt 2948 Hole.zip 216 Unoccupied.reg -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe -
Loads dropped DLL 5 IoCs
pid Process 3480 Empty.jpg 3004 Blank.doc 3616 Zero.txt 2948 Hole.zip 216 Unoccupied.reg -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Secure64 = "C:\\Windows\\system32\\dllcache\\Regedit32.com StartUp" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Secure32 = "C:\\Windows\\system32\\dllcache\\Shell32.com StartUp" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Blank AntiViri = "C:\\AUT0EXEC.BAT StartUp" Zero.txt Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Secure64 = "C:\\Windows\\system32\\dllcache\\Regedit32.com StartUp" Zero.txt Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Secure32 = "C:\\Windows\\system32\\dllcache\\Shell32.com StartUp" Zero.txt Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Blank AntiViri = "C:\\AUT0EXEC.BAT StartUp" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Blank.doc File opened (read-only) \??\P: Blank.doc File opened (read-only) \??\Q: Blank.doc File opened (read-only) \??\U: Blank.doc File opened (read-only) \??\W: Blank.doc File opened (read-only) \??\Z: Blank.doc File opened (read-only) \??\E: Blank.doc File opened (read-only) \??\G: Blank.doc File opened (read-only) \??\J: Blank.doc File opened (read-only) \??\S: Blank.doc File opened (read-only) \??\V: Blank.doc File opened (read-only) \??\X: Blank.doc File opened (read-only) \??\F: Blank.doc File opened (read-only) \??\H: Blank.doc File opened (read-only) \??\M: Blank.doc File opened (read-only) \??\N: Blank.doc File opened (read-only) \??\O: Blank.doc File opened (read-only) \??\T: Blank.doc File opened (read-only) \??\B: Blank.doc File opened (read-only) \??\I: Blank.doc File opened (read-only) \??\Y: Blank.doc File opened (read-only) \??\K: Blank.doc File opened (read-only) \??\R: Blank.doc -
Drops file in System32 directory 26 IoCs
description ioc Process File created C:\Windows\SysWOW64\dllChache\msvbvm60.dll 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllcache\msvbvm60.dll 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllChache\Zero.txt 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllChache\Unoccupied.reg 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\M5VBVM60.EXE 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllChache\msvbvm60.dll 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllChache\Hole.zip 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllcache\Regedit32.com 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllcache\Shell32.com 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllChache\Empty.jpg 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\rund1132.exe 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\rund1132.exe 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllcache\Shell32.com 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllchache 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllcache\msvbvm60.dll 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllChache\Empty.jpg 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllChache\Blank.doc 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllChache\Blank.doc 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllChache\Zero.txt 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllChache\Hole.zip 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllChache\Unoccupied.reg 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllcache\Regedit32.com 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\M5VBVM60.EXE 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\SysWOW64\dllchache.exe 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\SysWOW64\dllchache.exe 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File opened for modification C:\Windows\system32.exe 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe File created C:\Windows\system32.exe 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe -
Modifies registry class 42 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = ca0031000000000043553d2f17003739433543337e310000b20009000400efbe43553d2f43553d2f2e000000182e02000000010000000000000000000000000000002c5d13013700390063003500630033003100320061003700620062003400340036006100360066003800380031003400340036003900390036003800380034006300620032003300340064006300640063003600310038003300300062003500650063006400350037003900630039006100370035003000640035003400630063003100000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e0031000000000043553d2f100054656d7000003a0009000400efbe21550a5843553d2f2e00000093e10100000001000000000000000000000000000000b788bd00540065006d007000000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 780031000000000021550a581100557365727300640009000400efbe874f774843553c2f2e000000c70500000000010000000000000000003a0000000000df3ef30055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000002155f360100041646d696e003c0009000400efbe21550a5843553c2f2e00000074e101000000010000000000000000000000000000006969a900410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000002155fc5a10004c6f63616c003c0009000400efbe21550a5843553c2f2e00000092e10100000001000000000000000000000000000000a64ac5004c006f00630061006c00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\SysWow64\\rund1132.exe %1" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\rund1132.exe %1" 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\rund1132.exe %1" Zero.txt Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\SysWow64\\rund1132.exe %1" Zero.txt Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 560031000000000021550a5812004170704461746100400009000400efbe21550a5843553c2f2e0000007fe101000000010000000000000000000000000000008909d9004100700070004400610074006100000016000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4616 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 3004 Blank.doc 3004 Blank.doc 3004 Blank.doc 3004 Blank.doc 3616 Zero.txt 3616 Zero.txt 3616 Zero.txt 3616 Zero.txt 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 3480 Empty.jpg 2948 Hole.zip 2948 Hole.zip 2948 Hole.zip 2948 Hole.zip 216 Unoccupied.reg 216 Unoccupied.reg 216 Unoccupied.reg 216 Unoccupied.reg 3004 Blank.doc 3004 Blank.doc 3004 Blank.doc 3004 Blank.doc 3480 Empty.jpg 3480 Empty.jpg 2948 Hole.zip 2948 Hole.zip 3480 Empty.jpg 2948 Hole.zip 2948 Hole.zip 3480 Empty.jpg 216 Unoccupied.reg 216 Unoccupied.reg 3004 Blank.doc 3004 Blank.doc 216 Unoccupied.reg 216 Unoccupied.reg -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4616 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 3480 Empty.jpg 3004 Blank.doc 3616 Zero.txt 2948 Hole.zip 216 Unoccupied.reg 4616 explorer.exe 4616 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1460 wrote to memory of 3480 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 84 PID 1460 wrote to memory of 3480 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 84 PID 1460 wrote to memory of 3480 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 84 PID 1460 wrote to memory of 3004 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 85 PID 1460 wrote to memory of 3004 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 85 PID 1460 wrote to memory of 3004 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 85 PID 1460 wrote to memory of 3616 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 87 PID 1460 wrote to memory of 3616 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 87 PID 1460 wrote to memory of 3616 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 87 PID 1460 wrote to memory of 2948 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 88 PID 1460 wrote to memory of 2948 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 88 PID 1460 wrote to memory of 2948 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 88 PID 1460 wrote to memory of 216 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 89 PID 1460 wrote to memory of 216 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 89 PID 1460 wrote to memory of 216 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 89 PID 1460 wrote to memory of 4168 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 90 PID 1460 wrote to memory of 4168 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 90 PID 1460 wrote to memory of 4168 1460 79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe"C:\Users\Admin\AppData\Local\Temp\79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\dllChache\Empty.jpgC:\Windows\system32\dllChache\Empty.jpg ReStart2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3480
-
-
C:\Windows\SysWOW64\dllChache\Blank.docC:\Windows\system32\dllChache\Blank.doc ReStart2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
C:\Windows\SysWOW64\dllChache\Zero.txtC:\Windows\system32\dllChache\Zero.txt ReStart2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3616
-
-
C:\Windows\SysWOW64\dllChache\Hole.zipC:\Windows\system32\dllChache\Hole.zip ReStart2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2948
-
-
C:\Windows\SysWOW64\dllChache\Unoccupied.regC:\Windows\system32\dllChache\Unoccupied.reg ReStart2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:216
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\79c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc12⤵PID:4168
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4616
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
37KB
MD563fa1704b4bbeda36f9a1d254fae9166
SHA1a4a8f7bc74334a548e6055b7ac82459ec6892dd3
SHA25679c5c312a7bb446a6f881446996884cb234dcdc61830b5ecd579c9a750d54cc1
SHA512e61059dcf3b9e8941dae1aed552eb0cf1d3f3f6183695842b5c2e7e8221aeb6d9f0749c9f7a073909baae5184cfc372204e2211814135b70eeaa8b8c65ecb6d8
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a