Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe
Resource
win10v2004-20220812-en
General
-
Target
df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe
-
Size
840KB
-
MD5
024ffc0a906b6ef8618e02c6349b1e61
-
SHA1
eebb32abf9151f35345869181eb8ffb88f21fabe
-
SHA256
df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2
-
SHA512
00982b9809900bb2cc05592c5d03608c43823bab0f377766b476e248c0ff2716041fab3ae7c4c1a9d6527e0e483078207c15e47ec7c7fa0579372c0ee93d27d9
-
SSDEEP
12288:gCpyvXFPTfnCvX66h/NYJ9nDW6FApNg3gZqdDUtOuBiMc/j6KRVrxn7Nl4+GtlrL:dk9P7nCvX6MNYLIbgYJ3chra+GbrL
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sioemof.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d3WQGzd9.exe -
Executes dropped EXE 9 IoCs
pid Process 4212 d3WQGzd9.exe 5012 awhost.exe 3972 sioemof.exe 4520 bwhost.exe 460 bwhost.exe 1484 cwhost.exe 2256 cwhost.exe 1400 cwhost.exe 3436 dwhost.exe -
resource yara_rule behavioral2/memory/1484-175-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/2256-179-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/1484-181-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/1400-185-0x0000000000400000-0x0000000000449000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation d3WQGzd9.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Program Files (x86)\\Internet Explorer\\lvvm.exe" cwhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /d" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /D" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /Q" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /b" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /M" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /w" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /N" d3WQGzd9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /y" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /o" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /j" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /R" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /l" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /B" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /s" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /F" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /L" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /Z" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /f" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /P" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /g" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /K" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /v" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /S" sioemof.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /J" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /E" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /W" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /x" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /u" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /n" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /C" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /T" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /i" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /Y" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /z" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /r" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /N" sioemof.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d3WQGzd9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /t" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /q" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /H" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /X" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /c" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /a" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /k" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /A" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /m" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /G" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /h" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /e" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /p" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /V" sioemof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sioemof = "C:\\Users\\Admin\\sioemof.exe /O" sioemof.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1884 set thread context of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 5012 set thread context of 208 5012 awhost.exe 86 PID 4520 set thread context of 460 4520 bwhost.exe 94 PID 460 set thread context of 4220 460 bwhost.exe 95 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\lvvm.exe cwhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 4296 208 WerFault.exe 86 4460 4220 WerFault.exe 95 -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 5004 tasklist.exe 1988 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4212 d3WQGzd9.exe 4212 d3WQGzd9.exe 4212 d3WQGzd9.exe 4212 d3WQGzd9.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe 3972 sioemof.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5004 tasklist.exe Token: SeDebugPrivilege 1988 tasklist.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 4212 d3WQGzd9.exe 5012 awhost.exe 3972 sioemof.exe 4520 bwhost.exe 3436 dwhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 1884 wrote to memory of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 1884 wrote to memory of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 1884 wrote to memory of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 1884 wrote to memory of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 1884 wrote to memory of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 1884 wrote to memory of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 1884 wrote to memory of 1652 1884 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 80 PID 1652 wrote to memory of 4212 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 81 PID 1652 wrote to memory of 4212 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 81 PID 1652 wrote to memory of 4212 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 81 PID 1652 wrote to memory of 5012 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 84 PID 1652 wrote to memory of 5012 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 84 PID 1652 wrote to memory of 5012 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 84 PID 4212 wrote to memory of 3972 4212 d3WQGzd9.exe 85 PID 4212 wrote to memory of 3972 4212 d3WQGzd9.exe 85 PID 4212 wrote to memory of 3972 4212 d3WQGzd9.exe 85 PID 5012 wrote to memory of 208 5012 awhost.exe 86 PID 5012 wrote to memory of 208 5012 awhost.exe 86 PID 5012 wrote to memory of 208 5012 awhost.exe 86 PID 5012 wrote to memory of 208 5012 awhost.exe 86 PID 4212 wrote to memory of 3924 4212 d3WQGzd9.exe 88 PID 4212 wrote to memory of 3924 4212 d3WQGzd9.exe 88 PID 4212 wrote to memory of 3924 4212 d3WQGzd9.exe 88 PID 3924 wrote to memory of 5004 3924 cmd.exe 91 PID 3924 wrote to memory of 5004 3924 cmd.exe 91 PID 3924 wrote to memory of 5004 3924 cmd.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 1652 wrote to memory of 4520 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 93 PID 1652 wrote to memory of 4520 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 93 PID 1652 wrote to memory of 4520 1652 df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe 93 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 3972 wrote to memory of 5004 3972 sioemof.exe 91 PID 4520 wrote to memory of 460 4520 bwhost.exe 94 PID 4520 wrote to memory of 460 4520 bwhost.exe 94 PID 4520 wrote to memory of 460 4520 bwhost.exe 94 PID 4520 wrote to memory of 460 4520 bwhost.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe"C:\Users\Admin\AppData\Local\Temp\df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe"C:\Users\Admin\AppData\Local\Temp\df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\d3WQGzd9.exeC:\Users\Admin\d3WQGzd9.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\sioemof.exe"C:\Users\Admin\sioemof.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del d3WQGzd9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
-
-
C:\Users\Admin\awhost.exeC:\Users\Admin\awhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 845⤵
- Program crash
PID:4296
-
-
-
-
C:\Users\Admin\bwhost.exeC:\Users\Admin\bwhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\bwhost.exe"C:\Users\Admin\bwhost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:460 -
C:\Windows\explorer.exe000000D8*5⤵PID:4220
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4220 -s 6646⤵
- Program crash
PID:4460
-
-
-
-
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1484 -
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Roaming\conhost.exe%C:\Users\Admin\AppData\Roaming4⤵
- Executes dropped EXE
PID:2256
-
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Local\Temp\dwm.exe%C:\Users\Admin\AppData\Local\Temp4⤵
- Executes dropped EXE
PID:1400
-
-
-
C:\Users\Admin\dwhost.exeC:\Users\Admin\dwhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3436
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del df999d74bf1052d031b84164e5029508528bb76feb7ec14caa6b92abd129f8a2.exe3⤵PID:2284
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 208 -ip 2081⤵PID:2984
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 480 -p 4220 -ip 42201⤵PID:2360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
Filesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
Filesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
Filesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
Filesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
Filesize
364KB
MD5f1ecc169dc9e2334e780d948b7fb2e02
SHA11e563ae9346ddb4c3927a4a2c461ca028f94d336
SHA25669220d7331af84a3b6a21908dbaac5acefcb56d80ccfdd24fbf804d3439b3fcd
SHA51291bee1e37ba57b8b5540a7b66adb0d07f4787b54978f0d3d78d15db1203b342c7e4b2bedbf26a75e7c37c659818badd68579d9962d14de0e6efc10c0e1b0d237
-
Filesize
364KB
MD5f1ecc169dc9e2334e780d948b7fb2e02
SHA11e563ae9346ddb4c3927a4a2c461ca028f94d336
SHA25669220d7331af84a3b6a21908dbaac5acefcb56d80ccfdd24fbf804d3439b3fcd
SHA51291bee1e37ba57b8b5540a7b66adb0d07f4787b54978f0d3d78d15db1203b342c7e4b2bedbf26a75e7c37c659818badd68579d9962d14de0e6efc10c0e1b0d237