Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
f075c52ce064768d7567c841f269712b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f075c52ce064768d7567c841f269712b.exe
Resource
win10v2004-20220812-en
General
-
Target
f075c52ce064768d7567c841f269712b.exe
-
Size
137KB
-
MD5
f075c52ce064768d7567c841f269712b
-
SHA1
993d250b26e4660b93ba8e29af6cc9a46420e772
-
SHA256
65e48138eeec15a0fad5c341f62ecc31552c01db04db0fd2e8c39ac3e45fcff7
-
SHA512
59813726e98b1d889759e28391b9d82a596a9a37ba98f5e2fd9ddce7dcf15ed8d8a72037d01531a26d496fa891b0f67b3d0880f6fec09aa8f0c74488a45bda22
-
SSDEEP
3072:71i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU81:Zi/NjO5x0Xg+UGSYnuy3Oai/Nd
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Executes dropped EXE 1 IoCs
pid Process 1692 sys.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5} sys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "file:\\\\C:\\sys.exe" sys.exe -
Deletes itself 1 IoCs
pid Process 1488 cmd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\ie.bat sys.exe File created C:\WINDOWS\SysWOW64\qx.bat sys.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\WINDOWS\sys.exe sys.exe File opened for modification C:\WINDOWS\sys.exe attrib.exe File created C:\WINDOWS\sys.exe f075c52ce064768d7567c841f269712b.exe File opened for modification C:\WINDOWS\sys.exe f075c52ce064768d7567c841f269712b.exe File created C:\WINDOWS\sys.exe sys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
pid Process 1980 taskkill.exe 1516 taskkill.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\154.203.154.173\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ymtuku.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000c8f58823c53b965253a4aa7775c82a478db3bfd923f3c63bea87a1687c6a6aa7000000000e800000000200002000000049b999002242c9ed93ca18af0ff4898a65dbfee37958fc609ce6ac653f6d0330200000007b23f8b90e557015f314a2395d06f4b76b3d95b63f22b094b50cd81735e22d884000000017a9597992c0675acedbc49856f99f56800a8e6a5348a2ada92c8ed4a4ede116d7207eb678a1cb436172d292218b5e04de5896db1344dd57ca67ef8c7dc55f97 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main sys.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\ymtuku.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6EE3E141-442B-11ED-AEF5-42FEA5F7B9B2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\ymtuku.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371683875" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000083672412b28c8847aea0d49f5aa368b3e9a2c8705d0317f22eea55f1d87113a4000000000e8000000002000020000000f48eaa2ba8813023b3fd9c7ea8482a73c4282ed0f1af20a6dcf006d7ad73188d9000000052068745d5e216a88bd0726be8e3f21f1fb4d45308dc32075f6c025ffa70ab9100487158f2aaa199f05fce28cd33014af6a3a2b328f6f96e6bb3e110ff52466be242bbc78c67a847e35ce6532f666ed5357efe05ea30a746bdcbd0186505c85d4444d1a8beec6717756e3771618aace0b2ab3ceb35ab9a1b95c7534fcebade9fba82f8ff5f0a928960cd970e8bde592840000000ea0553e493d77e845969da6d0f277ae1ae686e92d5b29aed9c3a0b75f045bf141cba6a93eea5f4ec2e80509ccde5147920a7faa752542411a3dc4912a163350f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ymtuku.com\ = "63" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a5227638d8d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\ymtuku.com\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\154.203.154.173 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\154.203.154.173\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\154.203.154.173\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com" sys.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1692 sys.exe 1692 sys.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1516 taskkill.exe Token: SeDebugPrivilege 1980 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 960 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1016 f075c52ce064768d7567c841f269712b.exe 1692 sys.exe 960 iexplore.exe 960 iexplore.exe 844 IEXPLORE.EXE 844 IEXPLORE.EXE 844 IEXPLORE.EXE 844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1980 1016 f075c52ce064768d7567c841f269712b.exe 28 PID 1016 wrote to memory of 1980 1016 f075c52ce064768d7567c841f269712b.exe 28 PID 1016 wrote to memory of 1980 1016 f075c52ce064768d7567c841f269712b.exe 28 PID 1016 wrote to memory of 1980 1016 f075c52ce064768d7567c841f269712b.exe 28 PID 1016 wrote to memory of 1692 1016 f075c52ce064768d7567c841f269712b.exe 30 PID 1016 wrote to memory of 1692 1016 f075c52ce064768d7567c841f269712b.exe 30 PID 1016 wrote to memory of 1692 1016 f075c52ce064768d7567c841f269712b.exe 30 PID 1016 wrote to memory of 1692 1016 f075c52ce064768d7567c841f269712b.exe 30 PID 1692 wrote to memory of 1516 1692 sys.exe 31 PID 1692 wrote to memory of 1516 1692 sys.exe 31 PID 1692 wrote to memory of 1516 1692 sys.exe 31 PID 1692 wrote to memory of 1516 1692 sys.exe 31 PID 1016 wrote to memory of 1488 1016 f075c52ce064768d7567c841f269712b.exe 32 PID 1016 wrote to memory of 1488 1016 f075c52ce064768d7567c841f269712b.exe 32 PID 1016 wrote to memory of 1488 1016 f075c52ce064768d7567c841f269712b.exe 32 PID 1016 wrote to memory of 1488 1016 f075c52ce064768d7567c841f269712b.exe 32 PID 1692 wrote to memory of 960 1692 sys.exe 35 PID 1692 wrote to memory of 960 1692 sys.exe 35 PID 1692 wrote to memory of 960 1692 sys.exe 35 PID 1692 wrote to memory of 960 1692 sys.exe 35 PID 960 wrote to memory of 844 960 iexplore.exe 38 PID 960 wrote to memory of 844 960 iexplore.exe 38 PID 960 wrote to memory of 844 960 iexplore.exe 38 PID 960 wrote to memory of 844 960 iexplore.exe 38 PID 1692 wrote to memory of 580 1692 sys.exe 39 PID 1692 wrote to memory of 580 1692 sys.exe 39 PID 1692 wrote to memory of 580 1692 sys.exe 39 PID 1692 wrote to memory of 580 1692 sys.exe 39 PID 580 wrote to memory of 1356 580 cmd.exe 41 PID 580 wrote to memory of 1356 580 cmd.exe 41 PID 580 wrote to memory of 1356 580 cmd.exe 41 PID 580 wrote to memory of 1356 580 cmd.exe 41 PID 1692 wrote to memory of 1156 1692 sys.exe 42 PID 1692 wrote to memory of 1156 1692 sys.exe 42 PID 1692 wrote to memory of 1156 1692 sys.exe 42 PID 1692 wrote to memory of 1156 1692 sys.exe 42 PID 1156 wrote to memory of 1816 1156 cmd.exe 44 PID 1156 wrote to memory of 1816 1156 cmd.exe 44 PID 1156 wrote to memory of 1816 1156 cmd.exe 44 PID 1156 wrote to memory of 1816 1156 cmd.exe 44 PID 1692 wrote to memory of 1320 1692 sys.exe 45 PID 1692 wrote to memory of 1320 1692 sys.exe 45 PID 1692 wrote to memory of 1320 1692 sys.exe 45 PID 1692 wrote to memory of 1320 1692 sys.exe 45 PID 1320 wrote to memory of 632 1320 cmd.exe 47 PID 1320 wrote to memory of 632 1320 cmd.exe 47 PID 1320 wrote to memory of 632 1320 cmd.exe 47 PID 1320 wrote to memory of 632 1320 cmd.exe 47 PID 1692 wrote to memory of 1624 1692 sys.exe 48 PID 1692 wrote to memory of 1624 1692 sys.exe 48 PID 1692 wrote to memory of 1624 1692 sys.exe 48 PID 1692 wrote to memory of 1624 1692 sys.exe 48 PID 1624 wrote to memory of 1336 1624 cmd.exe 50 PID 1624 wrote to memory of 1336 1624 cmd.exe 50 PID 1624 wrote to memory of 1336 1624 cmd.exe 50 PID 1624 wrote to memory of 1336 1624 cmd.exe 50 PID 1692 wrote to memory of 1552 1692 sys.exe 51 PID 1692 wrote to memory of 1552 1692 sys.exe 51 PID 1692 wrote to memory of 1552 1692 sys.exe 51 PID 1692 wrote to memory of 1552 1692 sys.exe 51 PID 1552 wrote to memory of 924 1552 cmd.exe 53 PID 1552 wrote to memory of 924 1552 cmd.exe 53 PID 1552 wrote to memory of 924 1552 cmd.exe 53 PID 1552 wrote to memory of 924 1552 cmd.exe 53 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 1740 attrib.exe 1980 attrib.exe 1356 attrib.exe 1816 attrib.exe 632 attrib.exe 1336 attrib.exe 924 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f075c52ce064768d7567c841f269712b.exe"C:\Users\Admin\AppData\Local\Temp\f075c52ce064768d7567c841f269712b.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /im KSafeTray.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\WINDOWS\sys.exe"C:\WINDOWS\sys.exe"2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /im KSafeTray.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:960 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:844
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"3⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"4⤵
- Views/modifies file attributes
PID:1356
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"3⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"4⤵
- Views/modifies file attributes
PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"3⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"4⤵
- Views/modifies file attributes
PID:632
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"3⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"4⤵
- Views/modifies file attributes
PID:1336
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"3⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"4⤵
- Views/modifies file attributes
PID:924
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\sys.exe"3⤵PID:1784
-
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\WINDOWS\sys.exe"4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1740
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "c:\sys.exe"3⤵PID:1876
-
C:\Windows\SysWOW64\attrib.exeattrib +h "c:\sys.exe"4⤵
- Views/modifies file attributes
PID:1980
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del f075c52ce064768d7567c841f269712b.exe2⤵
- Deletes itself
PID:1488
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5706d6538fd37693ad6e2784b2ea35218
SHA1cabb2d92135c4f7c1e7a55053b0257495fab966c
SHA2563be2af083ffd1e6bf9762687183226aa01ec65b391afdfae8ecdafc247f5c77e
SHA5129c293e3c391918eba162a791c5e77d8c101bc30954de9fc19c1b3604ece3f293e7e26539626a20e15983b847ca2adb571b48ff2742b6617ebed9cf20faf496fe
-
Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F
Filesize226B
MD5fc5b2795e5ebd67e5536d407dcac9fb0
SHA15ce2449b50f2a8ad2a44d525bd874edffb7e700c
SHA256178bb5dbb52ffafa0ba2f511c977aff253b635d69aadae1c17fe2c427214fcc7
SHA5120634d4bd616e21e3cbbf12a603d235d949279dfe5416a9205d559c2d9701f34aad1ed77789abbc4efe5bc0a72c96f3684db1211d0b219256e93f420baebe8de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596300e0bd1d7f08376a84d8c7a321f5a
SHA17c3d8392cecca173552dc4dffaaf55669dafb9b2
SHA2569a3c76bf4c83c1b8f8fde886db0a6d31c237cc4e69aaa26632c907d171523a6f
SHA51212e1bb4c6c55de572559ea8ea7611ff5a5e88a0ef77ddd2d6c04a78c328d047aac975c77690e506e2cbda09027ff5902d8ed624bfb5309e935bf039c259b5ed6
-
Filesize
5KB
MD51a0398e77f4c2d30dc75536472e0f380
SHA1aaab27718cd4ea2cf6bf9eb8b9088cfbc0284d7c
SHA2566443f532d01f5a28f2bb187d1832680283825c4364a8963cc302516f5465d8ea
SHA5127547977c171c69dbe96fee2a4501ce3ce8a9d8f3d382bf8bb98f490f92eed88cf622145325914b4fee1fb5b2dbf443a03504ba09315dcd3b33cee0b2d1206e05
-
Filesize
607B
MD5e47b794e6a9239edd63f3ec9fb3cc970
SHA1e09deb085260f68a3fad895185d10b37b41bc40f
SHA256d6ad497738b8355cee131587eee17d8800644472cffd529f8e3678c843c8cd32
SHA5129fc4f9131151de02d567a34742b2710a0b25b44d6b79de711fab43097973d3e20c3f9437007fa7d24822507bb4e9bc2053018d5801ed43f78ffdc198266b1fd0
-
Filesize
137KB
MD5c24b64147ddfa8536580ef82dc13cfc1
SHA1a77805a700e730bf9e4a5ee9b39de1ec07986cdd
SHA256f622e7d384ff7a2fe66101994da031831091e51095d0ad3dccf9f24af983b143
SHA51244d30591dc99da40d23aa1f2bc6db3008b746b1d95c38021968527b6fd7d46c4e43e0d0fd26437ea1f531b7eb6ed17c88c6f64e863968a4f6dcaeabdf32c0bf9
-
Filesize
137KB
MD5c24b64147ddfa8536580ef82dc13cfc1
SHA1a77805a700e730bf9e4a5ee9b39de1ec07986cdd
SHA256f622e7d384ff7a2fe66101994da031831091e51095d0ad3dccf9f24af983b143
SHA51244d30591dc99da40d23aa1f2bc6db3008b746b1d95c38021968527b6fd7d46c4e43e0d0fd26437ea1f531b7eb6ed17c88c6f64e863968a4f6dcaeabdf32c0bf9
-
Filesize
137KB
MD500e31e7309dc92da5d1a17af220cac68
SHA1438d6007c8d3b388ca5a917c452c5bc5bdb1bd90
SHA2568330e20d5737b07ccab75b68adc4fa7bc5a3f446e08e90b6c57a909a747c3dbb
SHA5121df30ce005f6d8960692f72953388036c57658adc85661fa7652cdb3c6f2bea186ed8abc6820a5ba1a4248278ca62000f61b20adeff4ecfaface2cf1d55a81b8
-
Filesize
137KB
MD5c24b64147ddfa8536580ef82dc13cfc1
SHA1a77805a700e730bf9e4a5ee9b39de1ec07986cdd
SHA256f622e7d384ff7a2fe66101994da031831091e51095d0ad3dccf9f24af983b143
SHA51244d30591dc99da40d23aa1f2bc6db3008b746b1d95c38021968527b6fd7d46c4e43e0d0fd26437ea1f531b7eb6ed17c88c6f64e863968a4f6dcaeabdf32c0bf9