Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
14/10/2022, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe
Resource
win10v2004-20220812-en
General
-
Target
269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe
-
Size
59KB
-
MD5
6a1fcbe6ac7fc091844a1257c7fd135f
-
SHA1
2247ad4f1d3c8c9d0dbe1015aa1aa88b71dfb050
-
SHA256
269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f
-
SHA512
a01ec5857eec66cba3f6c4afc818a6423558fa9df1e74cb4def25c0eabcab894d14dea96ba2bcd254c82fc5299d7d4a5cf38aaa519e63fb45a2840703a53e387
-
SSDEEP
1536:+fomE60xemL6jBBFqcH5AXbHqqt3CI7S5Nr4kRaAg2YC6:+wmx+emLwBBFqcQbLtzsF4cc236
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Executes dropped EXE 1 IoCs
pid Process 2276 inl9CFE.tmp -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1612 attrib.exe 1484 attrib.exe -
Deletes itself 1 IoCs
pid Process 2592 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1324 269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe 1324 269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce rundll32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe File opened for modification C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76FF3401-4BAC-11ED-9FD0-D6EA6736E294} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "189" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu3333.site\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu3333.site IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu3333.site\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu3333.site\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu3333.site IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.71628.com/?i" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?i" reg.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H) reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\"" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell reg.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 1536 rundll32.exe Token: SeRestorePrivilege 1536 rundll32.exe Token: SeRestorePrivilege 1536 rundll32.exe Token: SeRestorePrivilege 1536 rundll32.exe Token: SeRestorePrivilege 1536 rundll32.exe Token: SeRestorePrivilege 1536 rundll32.exe Token: SeRestorePrivilege 1536 rundll32.exe Token: SeRestorePrivilege 1592 rundll32.exe Token: SeRestorePrivilege 1592 rundll32.exe Token: SeRestorePrivilege 1592 rundll32.exe Token: SeRestorePrivilege 1592 rundll32.exe Token: SeRestorePrivilege 1592 rundll32.exe Token: SeRestorePrivilege 1592 rundll32.exe Token: SeRestorePrivilege 1592 rundll32.exe Token: SeIncBasePriorityPrivilege 1324 269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1528 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1528 iexplore.exe 1528 iexplore.exe 1832 IEXPLORE.EXE 1832 IEXPLORE.EXE 1832 IEXPLORE.EXE 1832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 700 1324 269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe 31 PID 1324 wrote to memory of 700 1324 269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe 31 PID 1324 wrote to memory of 700 1324 269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe 31 PID 1324 wrote to memory of 700 1324 269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe 31 PID 700 wrote to memory of 948 700 cmd.exe 32 PID 700 wrote to memory of 948 700 cmd.exe 32 PID 700 wrote to memory of 948 700 cmd.exe 32 PID 700 wrote to memory of 948 700 cmd.exe 32 PID 948 wrote to memory of 1528 948 cmd.exe 34 PID 948 wrote to memory of 1528 948 cmd.exe 34 PID 948 wrote to memory of 1528 948 cmd.exe 34 PID 948 wrote to memory of 1528 948 cmd.exe 34 PID 948 wrote to memory of 1536 948 cmd.exe 35 PID 948 wrote to memory of 1536 948 cmd.exe 35 PID 948 wrote to memory of 1536 948 cmd.exe 35 PID 948 wrote to memory of 1536 948 cmd.exe 35 PID 948 wrote to memory of 1536 948 cmd.exe 35 PID 948 wrote to memory of 1536 948 cmd.exe 35 PID 948 wrote to memory of 1536 948 cmd.exe 35 PID 948 wrote to memory of 1848 948 cmd.exe 36 PID 948 wrote to memory of 1848 948 cmd.exe 36 PID 948 wrote to memory of 1848 948 cmd.exe 36 PID 948 wrote to memory of 1848 948 cmd.exe 36 PID 1848 wrote to memory of 1140 1848 cmd.exe 38 PID 1848 wrote to memory of 1140 1848 cmd.exe 38 PID 1848 wrote to memory of 1140 1848 cmd.exe 38 PID 1848 wrote to memory of 1140 1848 cmd.exe 38 PID 1848 wrote to memory of 1036 1848 cmd.exe 39 PID 1848 wrote to memory of 1036 1848 cmd.exe 39 PID 1848 wrote to memory of 1036 1848 cmd.exe 39 PID 1848 wrote to memory of 1036 1848 cmd.exe 39 PID 1848 wrote to memory of 768 1848 cmd.exe 40 PID 1848 wrote to memory of 768 1848 cmd.exe 40 PID 1848 wrote to memory of 768 1848 cmd.exe 40 PID 1848 wrote to memory of 768 1848 cmd.exe 40 PID 1848 wrote to memory of 240 1848 cmd.exe 42 PID 1848 wrote to memory of 240 1848 cmd.exe 42 PID 1848 wrote to memory of 240 1848 cmd.exe 42 PID 1848 wrote to memory of 240 1848 cmd.exe 42 PID 1528 wrote to memory of 1832 1528 iexplore.exe 41 PID 1528 wrote to memory of 1832 1528 iexplore.exe 41 PID 1528 wrote to memory of 1832 1528 iexplore.exe 41 PID 1528 wrote to memory of 1832 1528 iexplore.exe 41 PID 1848 wrote to memory of 1728 1848 cmd.exe 43 PID 1848 wrote to memory of 1728 1848 cmd.exe 43 PID 1848 wrote to memory of 1728 1848 cmd.exe 43 PID 1848 wrote to memory of 1728 1848 cmd.exe 43 PID 1848 wrote to memory of 1612 1848 cmd.exe 44 PID 1848 wrote to memory of 1612 1848 cmd.exe 44 PID 1848 wrote to memory of 1612 1848 cmd.exe 44 PID 1848 wrote to memory of 1612 1848 cmd.exe 44 PID 1848 wrote to memory of 1484 1848 cmd.exe 45 PID 1848 wrote to memory of 1484 1848 cmd.exe 45 PID 1848 wrote to memory of 1484 1848 cmd.exe 45 PID 1848 wrote to memory of 1484 1848 cmd.exe 45 PID 1848 wrote to memory of 1592 1848 cmd.exe 46 PID 1848 wrote to memory of 1592 1848 cmd.exe 46 PID 1848 wrote to memory of 1592 1848 cmd.exe 46 PID 1848 wrote to memory of 1592 1848 cmd.exe 46 PID 1848 wrote to memory of 1592 1848 cmd.exe 46 PID 1848 wrote to memory of 1592 1848 cmd.exe 46 PID 1848 wrote to memory of 1592 1848 cmd.exe 46 PID 1848 wrote to memory of 1596 1848 cmd.exe 47 PID 1848 wrote to memory of 1596 1848 cmd.exe 47 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1612 attrib.exe 1484 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe"C:\Users\Admin\AppData\Local\Temp\269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\vmwarefusion4.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\PROGRA~1\INTERN~1\iexplore.exeC:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?716284⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1832
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf4⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat4⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1140
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1036
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?i"" /f5⤵PID:768
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f5⤵
- Modifies registry class
PID:240
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f5⤵
- Modifies registry class
PID:1728
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1612
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1484
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf5⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
PID:1480 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵PID:1468
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 D:\VolumeDH\inj.dat,MainLoad5⤵PID:1596
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inl9CFE.tmpC:\Users\Admin\AppData\Local\Temp\inl9CFE.tmp2⤵
- Executes dropped EXE
PID:2276
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\269D87~1.EXE > nul2⤵
- Deletes itself
PID:2592
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122.8MB
MD5446abdc1be7e417c8d994757c13b97aa
SHA1231239deb2a22e8ecc98ba9415c203a13d2b338e
SHA2561025f91c2dede7d12d152628c2d6f09fe09fea349f899655f308f07c32cf156e
SHA512aa2e4c9ab2ab79bf04dfaecb610fba4877f5104a2ec230cfd413e5a7219a78ab8c470f2ca0ee732041f6f3a4cae63de98425ef59c4752345a09c5af782143518
-
Filesize
53B
MD523962a245f75fe25510051582203aff1
SHA120832a3a1179bb2730194d2f7738d41d5d669a43
SHA2561abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647
SHA512dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80
-
Filesize
660B
MD5d980f89e4088711df685a0aa09e8f5a7
SHA1dde805f4fa5e016e122e4240e20ff844113717d7
SHA25628f62bd59962d06d903ea079466c66985caa306251717235a0d470a1b0f62d09
SHA512fa2a669d846081d71dcada405d3c4bdb92229ba2b4a9f8fd4e461d7c4d51012d3d3b893466f814c8178b9980119703d1a3f7eafeff281a2eb75465e504df9ee9
-
Filesize
3KB
MD5286fe459674aef6eee17f6ac79a15fdb
SHA1233dc43099c575a67b05fc1076e676324fd6e63d
SHA256872cc596dc1fe6d5a131129bd84c2a76d6874e9c57ab2cd792d4d12b6f014fd2
SHA512c9acc4a134001da76e7ae6aa5ae65ce58501942dfc1f80959ae4db27c06010db753c9d115eedbe0b2b0e30dd5c4dcd1d32816493b053c65cee81d3a343c87314
-
Filesize
492B
MD534c14b8530e1094e792527f7a474fe77
SHA1f71c4e9091140256b34c18220d1dd1efab1f301d
SHA256fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713
SHA51225bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2
-
Filesize
3KB
MD5d4917ae9072a10d8e12ef3b282b25b3b
SHA1bd9ec6c6395997525ec7c15ecca2f115573cc14c
SHA2566f7649988962c61ac7644262ee6082ef352bbb00cb155a3f4ef0467fbdf1c67b
SHA512c6ed3119e008191ad56050f6b72a2d64e908c57e80fd0c252b8b1947cf091644c83b6bc16c56d6e2153579eb3e8711c8cd608977426a0906d56a7713bfca309d
-
Filesize
247B
MD5ca436f6f187bc049f9271ecdcbf348fa
SHA1bf8a548071cfc150f7affb802538edf03d281106
SHA2566cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534
SHA512d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591
-
Filesize
12.3MB
MD53ff5e57c33dd4a5010805d9d8a391a03
SHA1311f787c642b2c3d158a2a420ff6617bda563113
SHA2567b18be94bb8d091ede315f28fa6f564c22c1012fa92e85219be6b4d9d19d72ea
SHA51217a5c69d808cf1b749bef41dbdf44a86d57c5eee4ec095e4df545fbe32cb9a620a4ffcfcd1fc00b7f7a2a8370f8297b12091e50f44b0db36c93d724a07257632
-
Filesize
122.8MB
MD5446abdc1be7e417c8d994757c13b97aa
SHA1231239deb2a22e8ecc98ba9415c203a13d2b338e
SHA2561025f91c2dede7d12d152628c2d6f09fe09fea349f899655f308f07c32cf156e
SHA512aa2e4c9ab2ab79bf04dfaecb610fba4877f5104a2ec230cfd413e5a7219a78ab8c470f2ca0ee732041f6f3a4cae63de98425ef59c4752345a09c5af782143518
-
Filesize
122.8MB
MD5446abdc1be7e417c8d994757c13b97aa
SHA1231239deb2a22e8ecc98ba9415c203a13d2b338e
SHA2561025f91c2dede7d12d152628c2d6f09fe09fea349f899655f308f07c32cf156e
SHA512aa2e4c9ab2ab79bf04dfaecb610fba4877f5104a2ec230cfd413e5a7219a78ab8c470f2ca0ee732041f6f3a4cae63de98425ef59c4752345a09c5af782143518