Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe
Resource
win7-20220901-en
windows7-x64
27 signatures
150 seconds
General
-
Target
55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe
-
Size
2.3MB
-
MD5
692213b2c7610cdb5656fb1f138e181e
-
SHA1
1581c44c08e239417d1904a4b706fa2a7a742f71
-
SHA256
55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b
-
SHA512
55705633ef5c769b0618dc20f2d716535846e00d71ea7f727f079969353410561a4b85f6f5eca0be8a36eeb02b71a931c56fcd1d0c4b64658ad69912f417d9ff
-
SSDEEP
49152:OBrlCNnO0x9qk4QLH2mUrQOyH6A1retpOls:OBBoOa9UKWm0262y
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "2" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "2" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Blocks application from running via registry modification 18 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\ 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Drops file in Drivers directory 5 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\host_new 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File created C:\Windows\System32\drivers\etc\hosts 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened for modification C:\Windows\system32\drivers\etc\host_new 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolcv.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostproinstall.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssys.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvmd.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gav.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[3].exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscanx.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows Police Pro.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoler.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srexe.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.sweepsrv.sys.swnetsup.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setloadorder.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgdumpx.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcpevalsetup.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwtool16.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utpost.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntispywarXP2009.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrt.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shield.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oaview.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system32.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whoswatchingme.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\norton_internet_secu_3.0_407.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysupd.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secure Veteran.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshell.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\doors.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpf.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atupdater.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmavsp.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmon.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smrtdefp.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Save.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimp2.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prizesurfer.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprotect.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpd.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
resource yara_rule behavioral1/memory/944-56-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral1/memory/944-60-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral1/memory/944-61-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral1/memory/944-62-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral1/memory/944-63-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral1/memory/944-96-0x0000000013140000-0x000000001372E000-memory.dmp upx -
Loads dropped DLL 4 IoCs
pid Process 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 36 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Smart Security = "\"C:\\ProgramData\\7e910\\SS7c2.exe\" /s /d" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\ 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\X: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\Z: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\I: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\J: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\L: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\N: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\R: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\F: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\H: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\M: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\U: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\Y: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\G: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\K: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\P: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\T: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\V: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\W: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\E: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\O: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\Q: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1700 set thread context of 944 1700 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IIL = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ltHI = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ltTST = "40627" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler\ = "Implements DocHostUIHandler" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Software\Microsoft\Internet Explorer 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Software 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler\Clsid 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Software\Microsoft 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 944 1700 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 27 PID 1700 wrote to memory of 944 1700 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 27 PID 1700 wrote to memory of 944 1700 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 27 PID 1700 wrote to memory of 944 1700 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 27 PID 1700 wrote to memory of 944 1700 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 27 PID 1700 wrote to memory of 944 1700 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 27 PID 944 wrote to memory of 1272 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 28 PID 944 wrote to memory of 1272 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 28 PID 944 wrote to memory of 1272 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 28 PID 944 wrote to memory of 1272 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 28 PID 944 wrote to memory of 1072 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 29 PID 944 wrote to memory of 1072 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 29 PID 944 wrote to memory of 1072 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 29 PID 944 wrote to memory of 1072 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 29 PID 944 wrote to memory of 1940 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 32 PID 944 wrote to memory of 1940 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 32 PID 944 wrote to memory of 1940 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 32 PID 944 wrote to memory of 1940 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 32 PID 944 wrote to memory of 2008 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 35 PID 944 wrote to memory of 2008 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 35 PID 944 wrote to memory of 2008 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 35 PID 944 wrote to memory of 2008 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 35 PID 944 wrote to memory of 972 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 37 PID 944 wrote to memory of 972 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 37 PID 944 wrote to memory of 972 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 37 PID 944 wrote to memory of 972 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 37 PID 944 wrote to memory of 1012 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 39 PID 944 wrote to memory of 1012 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 39 PID 944 wrote to memory of 1012 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 39 PID 944 wrote to memory of 1012 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 39 PID 944 wrote to memory of 1676 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 41 PID 944 wrote to memory of 1676 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 41 PID 944 wrote to memory of 1676 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 41 PID 944 wrote to memory of 1676 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 41 PID 944 wrote to memory of 1980 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 43 PID 944 wrote to memory of 1980 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 43 PID 944 wrote to memory of 1980 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 43 PID 944 wrote to memory of 1980 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 43 PID 944 wrote to memory of 1620 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 45 PID 944 wrote to memory of 1620 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 45 PID 944 wrote to memory of 1620 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 45 PID 944 wrote to memory of 1620 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 45 PID 944 wrote to memory of 1708 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 47 PID 944 wrote to memory of 1708 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 47 PID 944 wrote to memory of 1708 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 47 PID 944 wrote to memory of 1708 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 47 PID 944 wrote to memory of 1524 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 49 PID 944 wrote to memory of 1524 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 49 PID 944 wrote to memory of 1524 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 49 PID 944 wrote to memory of 1524 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 49 PID 944 wrote to memory of 1876 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 51 PID 944 wrote to memory of 1876 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 51 PID 944 wrote to memory of 1876 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 51 PID 944 wrote to memory of 1876 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 51 PID 944 wrote to memory of 1116 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 53 PID 944 wrote to memory of 1116 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 53 PID 944 wrote to memory of 1116 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 53 PID 944 wrote to memory of 1116 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 53 PID 944 wrote to memory of 1824 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 55 PID 944 wrote to memory of 1824 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 55 PID 944 wrote to memory of 1824 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 55 PID 944 wrote to memory of 1824 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 55 PID 944 wrote to memory of 1392 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 57 PID 944 wrote to memory of 1392 944 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 57 -
System policy modification 1 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "2" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "2" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe"C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe"C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe" "C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe"2⤵
- UAC bypass
- Enumerates VirtualBox registry keys
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:944 -
C:\Windows\SysWOW64\Wbem\mofcomp.exemofcomp "C:\Users\Admin\AppData\Local\Temp\7871.mof"3⤵PID:1272
-
-
C:\Windows\SysWOW64\netsh.exenetsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe" "System Smart Security" ENABLE3⤵PID:1072
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.com 8.8.8.83⤵PID:1940
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.net 8.8.8.83⤵PID:2008
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.com 208.67.222.2223⤵PID:972
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.net 208.67.222.2223⤵PID:1012
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.com 8.8.4.43⤵PID:1676
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.net 8.8.4.43⤵PID:1980
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.com 208.67.220.2203⤵PID:1620
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.net 208.67.220.2203⤵PID:1708
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.com 8.8.8.83⤵PID:1524
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.net 8.8.8.83⤵PID:1876
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.com 208.67.222.2223⤵PID:1116
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.net 208.67.222.2223⤵PID:1824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.com 8.8.4.43⤵PID:1392
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.net 8.8.4.43⤵PID:1320
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.com 208.67.220.2203⤵PID:1724
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.net 208.67.220.2203⤵PID:1952
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.com 8.8.8.83⤵PID:1364
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.net 8.8.8.83⤵PID:900
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.com 208.67.222.2223⤵PID:680
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.net 208.67.222.2223⤵PID:1060
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.com 8.8.4.43⤵PID:1592
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.net 8.8.4.43⤵PID:1548
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.com 208.67.220.2203⤵PID:2008
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.net 208.67.220.2203⤵PID:1820
-
-
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Bypass User Account Control
1Disabling Security Tools
1Modify Registry
5Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340B
MD55f7e430172b9f017406d3f63480893c3
SHA19371b41f2b9a0e83ae3177afcd6ddda91ed148ec
SHA2569813b3cc6a02db9dec3ae3d650d819a70ed54f388e66e5fdf336dfd2ea78328d
SHA512fe56c58fae7be1f5cf350284c0ce06a97d7c624a25523e0139914367e71434a947273b5f0b630e0f1882bb6efac6c574f6347a233afa81663bad44bee2290b45
-
Filesize
2.3MB
MD5692213b2c7610cdb5656fb1f138e181e
SHA11581c44c08e239417d1904a4b706fa2a7a742f71
SHA25655d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b
SHA51255705633ef5c769b0618dc20f2d716535846e00d71ea7f727f079969353410561a4b85f6f5eca0be8a36eeb02b71a931c56fcd1d0c4b64658ad69912f417d9ff
-
Filesize
2.3MB
MD5692213b2c7610cdb5656fb1f138e181e
SHA11581c44c08e239417d1904a4b706fa2a7a742f71
SHA25655d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b
SHA51255705633ef5c769b0618dc20f2d716535846e00d71ea7f727f079969353410561a4b85f6f5eca0be8a36eeb02b71a931c56fcd1d0c4b64658ad69912f417d9ff
-
Filesize
2.3MB
MD5692213b2c7610cdb5656fb1f138e181e
SHA11581c44c08e239417d1904a4b706fa2a7a742f71
SHA25655d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b
SHA51255705633ef5c769b0618dc20f2d716535846e00d71ea7f727f079969353410561a4b85f6f5eca0be8a36eeb02b71a931c56fcd1d0c4b64658ad69912f417d9ff
-
Filesize
2.3MB
MD5692213b2c7610cdb5656fb1f138e181e
SHA11581c44c08e239417d1904a4b706fa2a7a742f71
SHA25655d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b
SHA51255705633ef5c769b0618dc20f2d716535846e00d71ea7f727f079969353410561a4b85f6f5eca0be8a36eeb02b71a931c56fcd1d0c4b64658ad69912f417d9ff