Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18/10/2022, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe
-
Size
320KB
-
MD5
dfcd3efd5082839ae8b8ad90d9bcacd6
-
SHA1
56678944830d3e771383b592c6b61e34b6d55487
-
SHA256
fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61
-
SHA512
dd5a901ae879f5c4ad2e33820c91610bbd052ba9c53b88ac834cd894f2286308b92b050e29e6238cbba3cca304f4f11d4b2ecb0487f3d47ad2d3dca561696b46
-
SSDEEP
6144:wTw4o1IV3puaibGKFHi0mofhaH05kipz016580bHFMWu86JQPDHDdx/QtqR:+mgvmzFHi0mo5aH0qMzd5807FKPJQPDV
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" gtbeek.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtbeek.exe -
Adds policy Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhoqp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihbqcuvleqostldafs.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhoqp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghduicfxsggmpjdcjycd.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixhmownt = "ihbqcuvleqostldafs.exe" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixhmownt = "vxumbwatpefmqlggoejli.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixhmownt = "ttoerkmdxkjoqjcagux.exe" gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhoqp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sphueuthyiegfvlg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhoqp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe" gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixhmownt = "zxqepggvnyvyypgcg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixhmownt = "sphueuthyiegfvlg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhoqp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sphueuthyiegfvlg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixhmownt = "ihbqcuvleqostldafs.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhoqp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghduicfxsggmpjdcjycd.exe" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtbeek.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtbeek.exe -
Executes dropped EXE 2 IoCs
pid Process 1320 gtbeek.exe 1532 gtbeek.exe -
Loads dropped DLL 4 IoCs
pid Process 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghduicfxsggmpjdcjycd.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdragsnxkqig = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sphueuthyiegfvlg.exe" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gtbeek.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdragsnxkqig = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxumbwatpefmqlggoejli.exe" gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtbeek = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "ihbqcuvleqostldafs.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sjvcgqjrcg = "ihbqcuvleqostldafs.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdragsnxkqig = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghduicfxsggmpjdcjycd.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gtbeek = "zxqepggvnyvyypgcg.exe" gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihbqcuvleqostldafs.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtbeek = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sphueuthyiegfvlg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdragsnxkqig = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghduicfxsggmpjdcjycd.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfsafqktfkb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sphueuthyiegfvlg.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sjvcgqjrcg = "ghduicfxsggmpjdcjycd.exe ." gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfsafqktfkb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttoerkmdxkjoqjcagux.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtbeek = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghduicfxsggmpjdcjycd.exe" gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpagjskrb = "ihbqcuvleqostldafs.exe" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpagjskrb = "ihbqcuvleqostldafs.exe" gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghduicfxsggmpjdcjycd.exe ." gtbeek.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe ." fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gtbeek = "vxumbwatpefmqlggoejli.exe" gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sjvcgqjrcg = "ttoerkmdxkjoqjcagux.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gtbeek = "ihbqcuvleqostldafs.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "zxqepggvnyvyypgcg.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpagjskrb = "sphueuthyiegfvlg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfsafqktfkb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe ." fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce gtbeek.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sjvcgqjrcg = "zxqepggvnyvyypgcg.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdragsnxkqig = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttoerkmdxkjoqjcagux.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gtbeek = "ttoerkmdxkjoqjcagux.exe" gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sjvcgqjrcg = "sphueuthyiegfvlg.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtbeek = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttoerkmdxkjoqjcagux.exe" gtbeek.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttoerkmdxkjoqjcagux.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "ttoerkmdxkjoqjcagux.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "sphueuthyiegfvlg.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdragsnxkqig = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfsafqktfkb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtbeek = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihbqcuvleqostldafs.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gtbeek = "ghduicfxsggmpjdcjycd.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "zxqepggvnyvyypgcg.exe ." gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "vxumbwatpefmqlggoejli.exe ." fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtbeek = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sphueuthyiegfvlg.exe" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpagjskrb = "ghduicfxsggmpjdcjycd.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gtbeek = "zxqepggvnyvyypgcg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfsafqktfkb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttoerkmdxkjoqjcagux.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxumbwatpefmqlggoejli.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "vxumbwatpefmqlggoejli.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtbeek = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihbqcuvleqostldafs.exe" gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sjvcgqjrcg = "zxqepggvnyvyypgcg.exe ." gtbeek.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtbeek = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thquvcs = "ghduicfxsggmpjdcjycd.exe ." gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdragsnxkqig = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxqepggvnyvyypgcg.exe" gtbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gtbeek = "zxqepggvnyvyypgcg.exe" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sjvcgqjrcg = "vxumbwatpefmqlggoejli.exe ." fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtbeek.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtbeek.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gtbeek.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyipaddress.com 6 whatismyip.everdot.org 13 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\xdeatsaxxqvgonmqcwflm.bai gtbeek.exe File opened for modification C:\Windows\SysWOW64\sjvcgqjrcgwslvfurwqhtaeohpaeuqjt.spu gtbeek.exe File created C:\Windows\SysWOW64\sjvcgqjrcgwslvfurwqhtaeohpaeuqjt.spu gtbeek.exe File opened for modification C:\Windows\SysWOW64\xdeatsaxxqvgonmqcwflm.bai gtbeek.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\xdeatsaxxqvgonmqcwflm.bai gtbeek.exe File created C:\Program Files (x86)\xdeatsaxxqvgonmqcwflm.bai gtbeek.exe File opened for modification C:\Program Files (x86)\sjvcgqjrcgwslvfurwqhtaeohpaeuqjt.spu gtbeek.exe File created C:\Program Files (x86)\sjvcgqjrcgwslvfurwqhtaeohpaeuqjt.spu gtbeek.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\xdeatsaxxqvgonmqcwflm.bai gtbeek.exe File created C:\Windows\xdeatsaxxqvgonmqcwflm.bai gtbeek.exe File opened for modification C:\Windows\sjvcgqjrcgwslvfurwqhtaeohpaeuqjt.spu gtbeek.exe File created C:\Windows\sjvcgqjrcgwslvfurwqhtaeohpaeuqjt.spu gtbeek.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1320 gtbeek.exe 1320 gtbeek.exe 1320 gtbeek.exe 1320 gtbeek.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1320 gtbeek.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1320 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 28 PID 1960 wrote to memory of 1320 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 28 PID 1960 wrote to memory of 1320 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 28 PID 1960 wrote to memory of 1320 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 28 PID 1960 wrote to memory of 1532 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 29 PID 1960 wrote to memory of 1532 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 29 PID 1960 wrote to memory of 1532 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 29 PID 1960 wrote to memory of 1532 1960 fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe 29 -
System policy modification 1 TTPs 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer gtbeek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" gtbeek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" gtbeek.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe"C:\Users\Admin\AppData\Local\Temp\fa6bf02d1da363992191fa1003bb9e1c6d7e61de1d798a99652d759e11d2ac61.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\gtbeek.exe"C:\Users\Admin\AppData\Local\Temp\gtbeek.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1320
-
-
C:\Users\Admin\AppData\Local\Temp\gtbeek.exe"C:\Users\Admin\AppData\Local\Temp\gtbeek.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:1532
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700KB
MD554e32dd82c236f65fa8560721b9e2183
SHA12faeba3e1e587cd70e9cb91d0376bebfadc42cd9
SHA2566ef3720c195a07d0f8a6a1246fbd1775059c3d0f43a3e5333b586d02bb4890cc
SHA512acb078085e878a67d3e4bd9f2bc0e65a16188aebcbef199b1419fc231da520e1f795e1262e6b82aa25bbaa7e22787ed07812c7892d98421c59ee6d9a1f90a341
-
Filesize
700KB
MD554e32dd82c236f65fa8560721b9e2183
SHA12faeba3e1e587cd70e9cb91d0376bebfadc42cd9
SHA2566ef3720c195a07d0f8a6a1246fbd1775059c3d0f43a3e5333b586d02bb4890cc
SHA512acb078085e878a67d3e4bd9f2bc0e65a16188aebcbef199b1419fc231da520e1f795e1262e6b82aa25bbaa7e22787ed07812c7892d98421c59ee6d9a1f90a341
-
Filesize
700KB
MD554e32dd82c236f65fa8560721b9e2183
SHA12faeba3e1e587cd70e9cb91d0376bebfadc42cd9
SHA2566ef3720c195a07d0f8a6a1246fbd1775059c3d0f43a3e5333b586d02bb4890cc
SHA512acb078085e878a67d3e4bd9f2bc0e65a16188aebcbef199b1419fc231da520e1f795e1262e6b82aa25bbaa7e22787ed07812c7892d98421c59ee6d9a1f90a341
-
Filesize
700KB
MD554e32dd82c236f65fa8560721b9e2183
SHA12faeba3e1e587cd70e9cb91d0376bebfadc42cd9
SHA2566ef3720c195a07d0f8a6a1246fbd1775059c3d0f43a3e5333b586d02bb4890cc
SHA512acb078085e878a67d3e4bd9f2bc0e65a16188aebcbef199b1419fc231da520e1f795e1262e6b82aa25bbaa7e22787ed07812c7892d98421c59ee6d9a1f90a341
-
Filesize
700KB
MD554e32dd82c236f65fa8560721b9e2183
SHA12faeba3e1e587cd70e9cb91d0376bebfadc42cd9
SHA2566ef3720c195a07d0f8a6a1246fbd1775059c3d0f43a3e5333b586d02bb4890cc
SHA512acb078085e878a67d3e4bd9f2bc0e65a16188aebcbef199b1419fc231da520e1f795e1262e6b82aa25bbaa7e22787ed07812c7892d98421c59ee6d9a1f90a341
-
Filesize
700KB
MD554e32dd82c236f65fa8560721b9e2183
SHA12faeba3e1e587cd70e9cb91d0376bebfadc42cd9
SHA2566ef3720c195a07d0f8a6a1246fbd1775059c3d0f43a3e5333b586d02bb4890cc
SHA512acb078085e878a67d3e4bd9f2bc0e65a16188aebcbef199b1419fc231da520e1f795e1262e6b82aa25bbaa7e22787ed07812c7892d98421c59ee6d9a1f90a341