Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe
Resource
win10v2004-20220812-en
General
-
Target
3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe
-
Size
496KB
-
MD5
6e86e0889f0bb8525ff5e1aa5e932150
-
SHA1
6d7f4772fd1cd73009293d79c94bf74b1b75256a
-
SHA256
3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
-
SHA512
6a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
SSDEEP
12288:kpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsc:kpUNr6YkVRFkgbeqeo68FhqR
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" vsmxiywcfcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tcjwein.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tcjwein.exe -
Adds policy Run key to start application 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\seoepwesym = "gcwwriayomsvpjipeiey.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\seoepwesym = "vsnokcvulkrvqlltjolgh.exe" vsmxiywcfcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\seoepwesym = "icuslaqmawabtlinac.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\seoepwesym = "skawnaoiuoqpfvqt.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tcjwein = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zsjgymbwjehhyplpb.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\seoepwesym = "zsjgymbwjehhyplpb.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tcjwein = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsnokcvulkrvqlltjolgh.exe" tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vsmxiywcfcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\seoepwesym = "vsnokcvulkrvqlltjolgh.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\seoepwesym = "vsnokcvulkrvqlltjolgh.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tcjwein = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsnokcvulkrvqlltjolgh.exe" vsmxiywcfcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\seoepwesym = "tohgaqhetqvxqjhnbez.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tcjwein = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tohgaqhetqvxqjhnbez.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tcjwein = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icuslaqmawabtlinac.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tcjwein = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skawnaoiuoqpfvqt.exe" tcjwein.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vsmxiywcfcw.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tcjwein.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tcjwein.exe -
Executes dropped EXE 3 IoCs
pid Process 892 vsmxiywcfcw.exe 1976 tcjwein.exe 1716 tcjwein.exe -
Loads dropped DLL 6 IoCs
pid Process 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 892 vsmxiywcfcw.exe 892 vsmxiywcfcw.exe 892 vsmxiywcfcw.exe 892 vsmxiywcfcw.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gcwwriayomsvpjipeiey.exe ." vsmxiywcfcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "tohgaqhetqvxqjhnbez.exe" tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nalcowfubqn = "icuslaqmawabtlinac.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kaoixiumwoolzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skawnaoiuoqpfvqt.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "gcwwriayomsvpjipeiey.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kykcpyiygwup = "gcwwriayomsvpjipeiey.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zsjgymbwjehhyplpb.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "tohgaqhetqvxqjhnbez.exe" vsmxiywcfcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce tcjwein.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gcwwriayomsvpjipeiey.exe" tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsnokcvulkrvqlltjolgh.exe ." tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "vsnokcvulkrvqlltjolgh.exe ." tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kaoixiumwoolzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icuslaqmawabtlinac.exe" tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run vsmxiywcfcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "vsnokcvulkrvqlltjolgh.exe ." vsmxiywcfcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "zsjgymbwjehhyplpb.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kykcpyiygwup = "skawnaoiuoqpfvqt.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsnokcvulkrvqlltjolgh.exe" tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nalcowfubqn = "gcwwriayomsvpjipeiey.exe" tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kaoixiumwoolzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tohgaqhetqvxqjhnbez.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jylescnenedzm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsnokcvulkrvqlltjolgh.exe ." tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jylescnenedzm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gcwwriayomsvpjipeiey.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kykcpyiygwup = "vsnokcvulkrvqlltjolgh.exe ." tcjwein.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "vsnokcvulkrvqlltjolgh.exe ." tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kaoixiumwoolzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zsjgymbwjehhyplpb.exe" vsmxiywcfcw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skawnaoiuoqpfvqt.exe ." tcjwein.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vsmxiywcfcw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kykcpyiygwup = "icuslaqmawabtlinac.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kykcpyiygwup = "icuslaqmawabtlinac.exe ." vsmxiywcfcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nalcowfubqn = "tohgaqhetqvxqjhnbez.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "skawnaoiuoqpfvqt.exe ." tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "icuslaqmawabtlinac.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nalcowfubqn = "icuslaqmawabtlinac.exe" vsmxiywcfcw.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "vsnokcvulkrvqlltjolgh.exe" tcjwein.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icuslaqmawabtlinac.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nalcowfubqn = "icuslaqmawabtlinac.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kaoixiumwoolzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gcwwriayomsvpjipeiey.exe" tcjwein.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce vsmxiywcfcw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gcwwriayomsvpjipeiey.exe" vsmxiywcfcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "gcwwriayomsvpjipeiey.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "skawnaoiuoqpfvqt.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jylescnenedzm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zsjgymbwjehhyplpb.exe ." tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "zsjgymbwjehhyplpb.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "tohgaqhetqvxqjhnbez.exe ." tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kaoixiumwoolzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gcwwriayomsvpjipeiey.exe" tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kykcpyiygwup = "gcwwriayomsvpjipeiey.exe ." tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kaoixiumwoolzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skawnaoiuoqpfvqt.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "vsnokcvulkrvqlltjolgh.exe" tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nalcowfubqn = "zsjgymbwjehhyplpb.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jylescnenedzm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skawnaoiuoqpfvqt.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gcwwriayomsvpjipeiey.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jylescnenedzm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skawnaoiuoqpfvqt.exe ." tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsnokcvulkrvqlltjolgh.exe ." tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce vsmxiywcfcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kaoixiumwoolzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tohgaqhetqvxqjhnbez.exe" tcjwein.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\isaoxciu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skawnaoiuoqpfvqt.exe" tcjwein.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktisyfsx = "tohgaqhetqvxqjhnbez.exe ." tcjwein.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vsmxiywcfcw.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tcjwein.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tcjwein.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 www.showmyipaddress.com 2 whatismyip.everdot.org 5 whatismyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vsnokcvulkrvqlltjolgh.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\skawnaoiuoqpfvqt.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\gcwwriayomsvpjipeiey.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\mkgifysskksxtpqzqwuqsp.exe vsmxiywcfcw.exe File opened for modification C:\Windows\SysWOW64\skawnaoiuoqpfvqt.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\zsjgymbwjehhyplpb.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\vsnokcvulkrvqlltjolgh.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\mkgifysskksxtpqzqwuqsp.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\icuslaqmawabtlinac.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\tohgaqhetqvxqjhnbez.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\mkgifysskksxtpqzqwuqsp.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\gcwwriayomsvpjipeiey.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\zsjgymbwjehhyplpb.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\icuslaqmawabtlinac.exe tcjwein.exe File opened for modification C:\Windows\SysWOW64\tohgaqhetqvxqjhnbez.exe tcjwein.exe File created C:\Windows\SysWOW64\xyxccyvytwhponrdxghgl.heh tcjwein.exe File opened for modification C:\Windows\SysWOW64\zsjgymbwjehhyplpb.exe vsmxiywcfcw.exe File opened for modification C:\Windows\SysWOW64\icuslaqmawabtlinac.exe vsmxiywcfcw.exe File opened for modification C:\Windows\SysWOW64\gcwwriayomsvpjipeiey.exe vsmxiywcfcw.exe File created C:\Windows\SysWOW64\seoepwesymiblvkhmgscsdksgmawpzjy.aug tcjwein.exe File opened for modification C:\Windows\SysWOW64\xyxccyvytwhponrdxghgl.heh tcjwein.exe File opened for modification C:\Windows\SysWOW64\seoepwesymiblvkhmgscsdksgmawpzjy.aug tcjwein.exe File opened for modification C:\Windows\SysWOW64\skawnaoiuoqpfvqt.exe vsmxiywcfcw.exe File opened for modification C:\Windows\SysWOW64\tohgaqhetqvxqjhnbez.exe vsmxiywcfcw.exe File opened for modification C:\Windows\SysWOW64\vsnokcvulkrvqlltjolgh.exe vsmxiywcfcw.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\xyxccyvytwhponrdxghgl.heh tcjwein.exe File opened for modification C:\Program Files (x86)\seoepwesymiblvkhmgscsdksgmawpzjy.aug tcjwein.exe File created C:\Program Files (x86)\seoepwesymiblvkhmgscsdksgmawpzjy.aug tcjwein.exe File opened for modification C:\Program Files (x86)\xyxccyvytwhponrdxghgl.heh tcjwein.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\tohgaqhetqvxqjhnbez.exe vsmxiywcfcw.exe File opened for modification C:\Windows\mkgifysskksxtpqzqwuqsp.exe tcjwein.exe File opened for modification C:\Windows\gcwwriayomsvpjipeiey.exe tcjwein.exe File opened for modification C:\Windows\seoepwesymiblvkhmgscsdksgmawpzjy.aug tcjwein.exe File opened for modification C:\Windows\skawnaoiuoqpfvqt.exe vsmxiywcfcw.exe File opened for modification C:\Windows\zsjgymbwjehhyplpb.exe vsmxiywcfcw.exe File opened for modification C:\Windows\vsnokcvulkrvqlltjolgh.exe vsmxiywcfcw.exe File opened for modification C:\Windows\skawnaoiuoqpfvqt.exe tcjwein.exe File opened for modification C:\Windows\zsjgymbwjehhyplpb.exe tcjwein.exe File opened for modification C:\Windows\icuslaqmawabtlinac.exe tcjwein.exe File opened for modification C:\Windows\tohgaqhetqvxqjhnbez.exe tcjwein.exe File opened for modification C:\Windows\zsjgymbwjehhyplpb.exe tcjwein.exe File opened for modification C:\Windows\icuslaqmawabtlinac.exe vsmxiywcfcw.exe File opened for modification C:\Windows\gcwwriayomsvpjipeiey.exe vsmxiywcfcw.exe File opened for modification C:\Windows\mkgifysskksxtpqzqwuqsp.exe tcjwein.exe File opened for modification C:\Windows\vsnokcvulkrvqlltjolgh.exe tcjwein.exe File opened for modification C:\Windows\skawnaoiuoqpfvqt.exe tcjwein.exe File opened for modification C:\Windows\vsnokcvulkrvqlltjolgh.exe tcjwein.exe File opened for modification C:\Windows\xyxccyvytwhponrdxghgl.heh tcjwein.exe File created C:\Windows\seoepwesymiblvkhmgscsdksgmawpzjy.aug tcjwein.exe File opened for modification C:\Windows\mkgifysskksxtpqzqwuqsp.exe vsmxiywcfcw.exe File opened for modification C:\Windows\gcwwriayomsvpjipeiey.exe tcjwein.exe File created C:\Windows\xyxccyvytwhponrdxghgl.heh tcjwein.exe File opened for modification C:\Windows\icuslaqmawabtlinac.exe tcjwein.exe File opened for modification C:\Windows\tohgaqhetqvxqjhnbez.exe tcjwein.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1976 tcjwein.exe 1976 tcjwein.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 1976 tcjwein.exe 1976 tcjwein.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1976 tcjwein.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1376 wrote to memory of 892 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 28 PID 1376 wrote to memory of 892 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 28 PID 1376 wrote to memory of 892 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 28 PID 1376 wrote to memory of 892 1376 3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe 28 PID 892 wrote to memory of 1976 892 vsmxiywcfcw.exe 29 PID 892 wrote to memory of 1976 892 vsmxiywcfcw.exe 29 PID 892 wrote to memory of 1976 892 vsmxiywcfcw.exe 29 PID 892 wrote to memory of 1976 892 vsmxiywcfcw.exe 29 PID 892 wrote to memory of 1716 892 vsmxiywcfcw.exe 30 PID 892 wrote to memory of 1716 892 vsmxiywcfcw.exe 30 PID 892 wrote to memory of 1716 892 vsmxiywcfcw.exe 30 PID 892 wrote to memory of 1716 892 vsmxiywcfcw.exe 30 -
System policy modification 1 TTPs 34 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vsmxiywcfcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" vsmxiywcfcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tcjwein.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tcjwein.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tcjwein.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe"C:\Users\Admin\AppData\Local\Temp\3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\vsmxiywcfcw.exe"C:\Users\Admin\AppData\Local\Temp\vsmxiywcfcw.exe" "c:\users\admin\appdata\local\temp\3e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:892 -
C:\Users\Admin\AppData\Local\Temp\tcjwein.exe"C:\Users\Admin\AppData\Local\Temp\tcjwein.exe" "-C:\Users\Admin\AppData\Local\Temp\skawnaoiuoqpfvqt.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\tcjwein.exe"C:\Users\Admin\AppData\Local\Temp\tcjwein.exe" "-C:\Users\Admin\AppData\Local\Temp\skawnaoiuoqpfvqt.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1716
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
708KB
MD571102f37083afa4dbb21570ded0f6309
SHA1a3359321cfc392ec48eb87cd0b3ce4256ac3f1ce
SHA256114ee29836ebe00031c97fe8cc35fbee012c7192dc107943abd2efdef30b2861
SHA512f4d7f609652caefbf03d59ef58ed63d5a8e78c3f79d5cbf6a77239aed2656a199e7a37615f2221175bec85faed9e0619a444c56e6616295b76cda2eaebaa0d36
-
Filesize
708KB
MD571102f37083afa4dbb21570ded0f6309
SHA1a3359321cfc392ec48eb87cd0b3ce4256ac3f1ce
SHA256114ee29836ebe00031c97fe8cc35fbee012c7192dc107943abd2efdef30b2861
SHA512f4d7f609652caefbf03d59ef58ed63d5a8e78c3f79d5cbf6a77239aed2656a199e7a37615f2221175bec85faed9e0619a444c56e6616295b76cda2eaebaa0d36
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
320KB
MD516ad6085e048fef53d8c88e93913fe5b
SHA19775c3ee29c0453090cb0fe87118b74abbfe596c
SHA256a08880c15261801f4a5da1b4be1a158a2912f43136d705dcddb5213a9d5b1453
SHA51235227e47ae83a2643bae7941ff104dd0c0b2ab509025ded07224ede3ae5e315915e0603150bb1bb5077cbf76c379f9991d0b441db642708f467d884662f8fe09
-
Filesize
320KB
MD516ad6085e048fef53d8c88e93913fe5b
SHA19775c3ee29c0453090cb0fe87118b74abbfe596c
SHA256a08880c15261801f4a5da1b4be1a158a2912f43136d705dcddb5213a9d5b1453
SHA51235227e47ae83a2643bae7941ff104dd0c0b2ab509025ded07224ede3ae5e315915e0603150bb1bb5077cbf76c379f9991d0b441db642708f467d884662f8fe09
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
496KB
MD56e86e0889f0bb8525ff5e1aa5e932150
SHA16d7f4772fd1cd73009293d79c94bf74b1b75256a
SHA2563e0a6e18934ac4efdaf8a206a03a30715c6452f1ef1fc532b2cfa8006edf0249
SHA5126a606b635ce1f591646929c12125c0b56764b7f196f0cab9ced39724f7c4bc0f0c844a113e1ea112cf9db7fab537542d5faef908e6f92957c048ed3f0a018c64
-
Filesize
708KB
MD571102f37083afa4dbb21570ded0f6309
SHA1a3359321cfc392ec48eb87cd0b3ce4256ac3f1ce
SHA256114ee29836ebe00031c97fe8cc35fbee012c7192dc107943abd2efdef30b2861
SHA512f4d7f609652caefbf03d59ef58ed63d5a8e78c3f79d5cbf6a77239aed2656a199e7a37615f2221175bec85faed9e0619a444c56e6616295b76cda2eaebaa0d36
-
Filesize
708KB
MD571102f37083afa4dbb21570ded0f6309
SHA1a3359321cfc392ec48eb87cd0b3ce4256ac3f1ce
SHA256114ee29836ebe00031c97fe8cc35fbee012c7192dc107943abd2efdef30b2861
SHA512f4d7f609652caefbf03d59ef58ed63d5a8e78c3f79d5cbf6a77239aed2656a199e7a37615f2221175bec85faed9e0619a444c56e6616295b76cda2eaebaa0d36
-
Filesize
708KB
MD571102f37083afa4dbb21570ded0f6309
SHA1a3359321cfc392ec48eb87cd0b3ce4256ac3f1ce
SHA256114ee29836ebe00031c97fe8cc35fbee012c7192dc107943abd2efdef30b2861
SHA512f4d7f609652caefbf03d59ef58ed63d5a8e78c3f79d5cbf6a77239aed2656a199e7a37615f2221175bec85faed9e0619a444c56e6616295b76cda2eaebaa0d36
-
Filesize
708KB
MD571102f37083afa4dbb21570ded0f6309
SHA1a3359321cfc392ec48eb87cd0b3ce4256ac3f1ce
SHA256114ee29836ebe00031c97fe8cc35fbee012c7192dc107943abd2efdef30b2861
SHA512f4d7f609652caefbf03d59ef58ed63d5a8e78c3f79d5cbf6a77239aed2656a199e7a37615f2221175bec85faed9e0619a444c56e6616295b76cda2eaebaa0d36
-
Filesize
320KB
MD516ad6085e048fef53d8c88e93913fe5b
SHA19775c3ee29c0453090cb0fe87118b74abbfe596c
SHA256a08880c15261801f4a5da1b4be1a158a2912f43136d705dcddb5213a9d5b1453
SHA51235227e47ae83a2643bae7941ff104dd0c0b2ab509025ded07224ede3ae5e315915e0603150bb1bb5077cbf76c379f9991d0b441db642708f467d884662f8fe09
-
Filesize
320KB
MD516ad6085e048fef53d8c88e93913fe5b
SHA19775c3ee29c0453090cb0fe87118b74abbfe596c
SHA256a08880c15261801f4a5da1b4be1a158a2912f43136d705dcddb5213a9d5b1453
SHA51235227e47ae83a2643bae7941ff104dd0c0b2ab509025ded07224ede3ae5e315915e0603150bb1bb5077cbf76c379f9991d0b441db642708f467d884662f8fe09