Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe
Resource
win10v2004-20220812-en
General
-
Target
e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe
-
Size
310KB
-
MD5
8083604d5a1b2da798a7fafbc89ca13f
-
SHA1
6dab410a326b2868c286ea5a00481f2346a09c09
-
SHA256
e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc
-
SHA512
d3f8c5b2fcb6761e4fde061e724939f4390120db10946c426802c365a500f0189a9d4ecf167840876aa60e75f969648d20aff6c2e0a7730b554cd8905d2c31cc
-
SSDEEP
6144:K9Ufcke14K3KVzXrmZCJxDawuttfj0f5TNiFqQTeTdhkJ5Vb8b:SNk0KVzXzruttb0BNiFteJ+J3ob
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\progra~1\ico\$dpx$.tmp\204c22140c292644b436b0c294a0190a.tmp expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\12ce3943adde334fb916246fd41eee22.tmp expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\b4df9bbd8fe5bf4d935fe221519db26d.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\cfe8196d111ec0428713dcef9d4005ce.tmp expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\c095e81d2aa2994287514baa6e7f5bf7.tmp expand.exe File opened for modification C:\progra~1\ico\meiv.ico expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\d05bad6f3192b64d9f8b602aaa1c3dc1.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File opened for modification C:\progra~1\ico\Beauty.ico expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.779dh.com IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373153028" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\ename.com\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\618889.shop.ename.com\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\779dh.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\ename.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\mitao5.tv\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ec28f594e5d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\779dh.com\Total = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\mitao5.tv\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\mitao5.tv IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\mitao5.tv\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\ename.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\779dh.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\779dh.com\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "189" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000ba4695876d06e886136e073d3d55f1989a300b85c1a5ed179775e75c1295f6d4000000000e8000000002000020000000a7e9e0655e386cf854836f40ade938c6756fab7aaaa359d2d5841c6d82ce54e690000000aa84ad561fb5f5d35d64108d09c1afee7303a0a11d330a4bbc8badd9d4fd9ab6ef5e3aee7aefaae260eaab9a93a74b658014af4a66b3ca28ad8c7b1aab9ed9eb42d6acb22ce1e57bfdacea3aa78426795748394012677cc66cc52b868dd734be13d9aaeccb3b2825dcfc805bee8fa457e33e3a4a70baee13c7ca51939dae56e42fcc51e98eb50030f058af5bdd6cf637400000004adb675fd706691f0a274ec20c582f6707a26463eea9f3748cb67fe479c2bb47c0b8939194a1978a012aef63c0b1c8004062d8785bb84ec86ace23fa02451942 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1848 iexplore.exe 1848 iexplore.exe 1848 iexplore.exe 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 1848 iexplore.exe 1848 iexplore.exe 632 IEXPLORE.EXE 632 IEXPLORE.EXE 1848 iexplore.exe 1848 iexplore.exe 1848 iexplore.exe 1848 iexplore.exe 1848 iexplore.exe 1848 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 1544 IEXPLORE.EXE 1544 IEXPLORE.EXE 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 1052 IEXPLORE.EXE 1052 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1312 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 29 PID 1164 wrote to memory of 1312 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 29 PID 1164 wrote to memory of 1312 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 29 PID 1164 wrote to memory of 1312 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 29 PID 1164 wrote to memory of 820 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 28 PID 1164 wrote to memory of 820 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 28 PID 1164 wrote to memory of 820 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 28 PID 1164 wrote to memory of 820 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 28 PID 1312 wrote to memory of 1084 1312 cmd.exe 31 PID 1312 wrote to memory of 1084 1312 cmd.exe 31 PID 1312 wrote to memory of 1084 1312 cmd.exe 31 PID 1312 wrote to memory of 1084 1312 cmd.exe 31 PID 1572 wrote to memory of 1848 1572 explorer.exe 34 PID 1572 wrote to memory of 1848 1572 explorer.exe 34 PID 1572 wrote to memory of 1848 1572 explorer.exe 34 PID 1848 wrote to memory of 632 1848 iexplore.exe 35 PID 1848 wrote to memory of 632 1848 iexplore.exe 35 PID 1848 wrote to memory of 632 1848 iexplore.exe 35 PID 1848 wrote to memory of 632 1848 iexplore.exe 35 PID 1164 wrote to memory of 684 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 37 PID 1164 wrote to memory of 684 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 37 PID 1164 wrote to memory of 684 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 37 PID 1164 wrote to memory of 684 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 37 PID 1164 wrote to memory of 1768 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 38 PID 1164 wrote to memory of 1768 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 38 PID 1164 wrote to memory of 1768 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 38 PID 1164 wrote to memory of 1768 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 38 PID 1164 wrote to memory of 836 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 39 PID 1164 wrote to memory of 836 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 39 PID 1164 wrote to memory of 836 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 39 PID 1164 wrote to memory of 836 1164 e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe 39 PID 1848 wrote to memory of 1544 1848 iexplore.exe 40 PID 1848 wrote to memory of 1544 1848 iexplore.exe 40 PID 1848 wrote to memory of 1544 1848 iexplore.exe 40 PID 1848 wrote to memory of 1544 1848 iexplore.exe 40 PID 1848 wrote to memory of 2016 1848 iexplore.exe 41 PID 1848 wrote to memory of 2016 1848 iexplore.exe 41 PID 1848 wrote to memory of 2016 1848 iexplore.exe 41 PID 1848 wrote to memory of 2016 1848 iexplore.exe 41 PID 1848 wrote to memory of 1988 1848 iexplore.exe 42 PID 1848 wrote to memory of 1988 1848 iexplore.exe 42 PID 1848 wrote to memory of 1988 1848 iexplore.exe 42 PID 1848 wrote to memory of 1988 1848 iexplore.exe 42 PID 1848 wrote to memory of 1052 1848 iexplore.exe 43 PID 1848 wrote to memory of 1052 1848 iexplore.exe 43 PID 1848 wrote to memory of 1052 1848 iexplore.exe 43 PID 1848 wrote to memory of 1052 1848 iexplore.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe"C:\Users\Admin\AppData\Local\Temp\e24490ef9837b18dc4ce45fc76a0346fe75c33bb616e32f437f0b9f4103a95bc.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:820
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\GURbu.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1084
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.q22.cc/?ukt2⤵PID:684
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v921.com/?uk2⤵PID:1768
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.779dh.com/?kj2⤵PID:836
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:632
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:472068 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:668673 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:603141 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275460 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize2KB
MD5bc68c4ccb08d2c94eb10c1918865ccae
SHA18256faeec3f3ec799819d5370195a60f0ec2bdb0
SHA25679313c35e9f5655225ab6d4564a396cf9d473d04909c04db10935c27959f677d
SHA512f6baa632cd93126c31a495e340e8f42e3f9b171b0975877e7a6725677fe57c8b51784be5366cedba022fea273cfe9ecfc5fce8546f2a76e1e6516e5865666933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize1KB
MD59029e812333f1ff443afe9e25f94a85e
SHA16c708d06b3dbd481f0a9886e1442e6ce0f252904
SHA2567e532f408df3b3afd34b9bbfc61b141882a45d89b89615a3f0bb576e2feb22fd
SHA51226b4d1f811f8627a76f096f56a72dd703bd94a2eddd4e25d55b0fb266c3ee7741bc7584a79b7a564d81acd300b7b7229203a2f6bd5c1787a59143207924bc282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize1KB
MD59029e812333f1ff443afe9e25f94a85e
SHA16c708d06b3dbd481f0a9886e1442e6ce0f252904
SHA2567e532f408df3b3afd34b9bbfc61b141882a45d89b89615a3f0bb576e2feb22fd
SHA51226b4d1f811f8627a76f096f56a72dd703bd94a2eddd4e25d55b0fb266c3ee7741bc7584a79b7a564d81acd300b7b7229203a2f6bd5c1787a59143207924bc282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B
Filesize1KB
MD57104a478813417c0fcfcaf5478911049
SHA1da1da29022bf34b4e553c16b3e62ece6b4086368
SHA256e9c5b1be8486dc3f7046c8b31163e7c10a2b859973e7fa18aad3a98583004bce
SHA512cad6fb54f2617fa12700fb2c22403d6987c217078d90e9746aabd9c335e9512903d237433ece093ad0686fdb88144eaca683b684e68dc3c7de7a6f8fb82dc7b5
-
Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
Filesize1KB
MD5a854e87725aa5948e8d6ffd6d490f167
SHA1310dffa69fa220e08b7e17e6cc7d45d48fcfee07
SHA256a870b136dae91d84c2983b86da4bc24af082b5785bab2c201564392913e617cc
SHA512949101a827a54cfbc2b80a4bc75d8c47b582df4e4deb2d0c289bda8fb79a9d7e3437e26474f2ab83cb77f1386946392eaf5a95b5c3b2fc2997199cc7e09417f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize1KB
MD56f87b747c0ec926b8969eda11e38ed47
SHA11647c83cf472b334a90eaeb5e4ccff330dfcd1b6
SHA25608e88ccaa0fb84d319204d1df87a40ec779ba0a379731061ffc59c826b28310b
SHA5121050f6e1afec818499c14cdadd74359e41770c15b05145b78d82bedf7e8e06b60d8f2a1259a3da7173948bbebba9c62d6b95b6530ebb096cc1bcfbe6753cf523
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD5ee895cd37d1bbafdf7a736b85dd47348
SHA15c182ae0d6ffc54c386763ad882256cedd8d0e7c
SHA256939346daba2e0757e14e822fd55350189708ac8d2d782b148e1744ee85c49aa5
SHA512b2f86fa2f14864ab155693804f0d5da4f13e0c9257743eb7376d49a6ce77d950f6e98bbda24030386578c0edb58f4ad3e50eaec2dcc10803a7dd314d703cf740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize488B
MD5f2774384059bf7fd6c2aae82ec6dc39b
SHA16b86d7d8c334c489fb70d5301384b7265dc26b90
SHA256f089e351e5225e02e9c278b6239212c155de03c041d672d7491a70175ac91467
SHA51243963a436747dc7923203e073ee7ddd994bf278712ee117692d0e85254973a76a36d900770659abd4ff2cdd32ee2751a2421421f3d737bc140624e03a642d43a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize508B
MD5f1d5c4d07f90c203a099021d8d0e0f3e
SHA12e0f24590b150f4553125daa113ab69859b56380
SHA256d1757244a53d4985e5c2c0bf4b274bd1cf7a1a1ba45c5b92be869d2bec724021
SHA512205ae665c4b162e7416da3f005a3369c51cbc7f9d1a3f9956e200a09a99d2debe5b026846601da361d44e1d4b587a2ee78a1912ee015afa4d237b833367f3921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize508B
MD5cfeae0ef88b0277459f6f89f7d7e4589
SHA1654f5ffc80c78954eae41e97b36310c0c45329ff
SHA2565b89ad6d8a7b420056a72fb84f2474efa14bbbedbe89eff835c3596edd7edf94
SHA5122f60ada42d86ffec024b03516f7f217ce0572812f1560a5824a2220839865bddef64cea3bcd358e0e94f963c1cb6cf479067a3a71c8e36a11558770336688a09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B
Filesize532B
MD5e86ab33a0f1ee56505fb0e60db1127ce
SHA1eac05e485ee886b904a69cdb862168161a606e60
SHA256a249961a0272607b88a4b36ff650b8462926c149ef6b9b19e5ad2592b039c23b
SHA512aece2668a73429ee58d642875682f6c259aae88ee05fe6e603136173ba5d702398055d7dbd1eb28c2c3081d3459038590b18657ec347fabf485ad938a5c84ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD5da9379193c2e1f87bb7079fdd404e7b9
SHA1f467962e88559afd79f49149bbe5d1c68829d095
SHA256c776ff1252b20eca9c4f4e92443aac2867716ae913b3dd2c03471be5d6fed5c5
SHA512107e9465d170d368e62ec173c2d31bddf6c88e3bf38266ef7910082ea0892706d5edbefa455ac2806a9f532737411c1dfbf56c4cbcb62dd7a3a109e7ddedd752
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506a70fd74256fede420635ba06a4d6ac
SHA125d79e8e81f26b29ff86e9e0f87f4ff1b74c6c60
SHA2561021e112187e648e83d26f5f60ddaf561466f49ad033c23c87c99c63890ab0c3
SHA5127e9e7bce5b2475524b943d601d6a4717b628d8970625fe7403e85ab67dc417b2f45d6135a6364d39a94a40976faafd28ec20f6a38a690cc87e574ca59197aaf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507785ceb57f01700d47f5b548ed0bbbe
SHA1642b758b2b38282a391063b790c1996a94085e78
SHA2565b2b18fa878b3796f612c2dc983a818e792b69926e83a52272ab7c8436d7b410
SHA5128fbc1b543ff7cd27174612acb7b6382e7bc28930b72b2e6fd63aad307bc1b04a2992b7dd3e038106b5e8c88eb29493680c6d348aed30ef6a0b8ca0eda0ed460e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c51026c0164dba3d2f2463d671ca633
SHA19541b819f8a13fa90a66fe6b25162822fe063cd5
SHA256eef3197f133a57240fa2e266a297863e92d0bad2c82e75146319bc0c94045ce6
SHA5121051d63147e148751ffc91bc6e95ff40f14ca84e873b1317471dc3e2d1688251e3bd62ec1e159bc7af439c1318a416fe7d28401e94fba9c993fef874432b5ef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0853206f643a4fd40f3ed1a4c3abb52
SHA115d457192528d7c7af04cb07d1fc2f7953f6ccfc
SHA2564defe26789ea8ac22716fb66a17f465b3aaa5655f92224c1fccc2b8396093363
SHA512e99b5a53716d9b9229c2b1ee96cc95705350762a5d1d5077f4fdf4cf8c5a068762c1d27830c7657a41559aeb56bd2d612b9c7dc07c73c3f025265dc836d736e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c88ca767ceb1a0077bfb99d68d251e00
SHA165beaba7b97d616ce89eed265c7d8e221f8ef4de
SHA2565c2469fb31e7ba6a64a71aba5167222a69852347e193c6a4ae072d7a3a8b6e01
SHA512323d0be5dcb3bb26b969ea5427feadfe876888306785c1b1576846cd5df23832b417e0e23050605d48316f17e61832d43dbc8fc9114023f22a3a18e80d76211c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
Filesize492B
MD5b6b2904f601cd3148c6270c16986b4d7
SHA16d6350a4a6858900c0169b1610696f7db6a5c5a8
SHA2565aacac3a4d60849123e1cac5e1e75fa900ef09b18a331c3acb206a2af98fa855
SHA5124ebcf53a19bd56ef18e0ab95c7b253b3d6ac2ffbf1dc9c82df9ae55710e2b2596041694edecb2609756a931c4b02d020558de833714f88abe84c8bae8ff18e70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize506B
MD5fe8e3e0a49a21d637679d284a7572b8e
SHA101244aa44732454657b1194ef9200a7a9e324f18
SHA2562e46ba72903613cffd9f67afda383242158518e8900fdc90b0887acb509efd83
SHA512b624b924a210f768ea02e44b87099caa9187b33d0ce65d407367f592a0e8c229567d85f79060257029ec965c9b6c8efa271f4e4e9201deb554e08b6dfedd2c19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD58b30cc3a58052ac465d925f1dac31b2f
SHA17bf2a6c47fc3507c2dbd2cad165a9e054d8929f7
SHA2569e1a6613af954be4a2d01f44982b26efec664428acd5ee201e18fc59e9abbd64
SHA512462bba604635736bf14104fc82c7cbc672e6a41a067087ac40fc2c003d247ca1c92fc20b8d44f3e63fba9f96fc07d9f9075d0e029003709f258dab4f9f32d7c1
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
113B
MD52549fce6b8c485e1f0d7e01cdaa6c5d7
SHA133bc3d66ada3e9dc15ea0618316f5a4c40417668
SHA256d0ee20224f74ebcc1f62619b1f79e55abffa2baec4424dad24206de3953455c5
SHA512857fcfc8bb0eeb919751bca1d685c8092b3a7e166ab702e7f319cdbccfb8e5e3a338627e2ab9f0d79f59a6668c41fcf30deaeb605f18f8a5b64c1c5e76326151
-
Filesize
598B
MD51de09549fb5eb0d1a9e163d064bd6434
SHA1309792cac5314612cc3c7560df1b3f9469ef6af7
SHA25680a07f9970c6205c03ef40e2ea2d6453ca0bf39cc09b0fd7bcbc2cac846641d0
SHA5124780adfa786eba99cca00e4f9f3046af32439ca76b5e60cd984eb779603af4e62995245ab99390705d1f27e663cc8943983a29d090b1394a749a0fa4425b34c0
-
Filesize
115B
MD56869da75a45c7a91f15e75e21b8851a4
SHA12f46d6de6beb639ed204b628c92d4f39294f4473
SHA25648906747472189de25fa60d2db65914daa1d9f1d0e3520c947369db1fd868e46
SHA5121bfd6d15d8aaff6fdb4583595593d54562027ff40aad5901f2a367d0dc99049543f6a16aa7c9b34737ebc1c5fddf46913a23d04f355edfcd2d11844c14d5d60d
-
Filesize
94B
MD58b622977f1c83f4df37eacedea782ab1
SHA1531f2817af7f8dc9dad024d90f0cf9619d0b9eeb
SHA256beaf21310df4118bdde5c29f2e60e4a391769f1af07cb356d7614fa51ff597b3
SHA512666fd9b08acd008500c7afd67cc287ae04590097d801993ea6a194e09cb0b7b03d0f96e751166014dd3f67faae4b542f7f243673c089a64c7fee969c6ad8da1a
-
Filesize
226B
MD5720ef0fdedb872983d2877a4a39632ac
SHA103ed8c39ccb3a820cd2da305ac6e700b692d69a5
SHA2568efc0bb477afe8ec5ac175bd89cb0b474fa6372b7a0e2576a2770f2a45a7f9c6
SHA512dd41831bdc2829a323bd6feff9f86a8f91a2a9f5155e5e1b5df463de3b308f6b0496ff19aee47e2434c047df6168fbc7eaba3c28690064c120748b00ef2ad055
-
Filesize
319B
MD5599e18e27ca2244e937e4a0b1757eefa
SHA1d56343b5501ec49613070fd72b7d1da0840adbaf
SHA256427e1ef42d2e60e31ae501f72379e2fcc43cf5e0f46d9e10378fa3e1833d65bc
SHA5120c965142521bad13e9f9d1ab8602f4f15d4ae245d0c98dcca91b2f49a505fc541490a6d83c6e3c716596d3815c3236ec71a6b7f58bef4926de93cde7450426cf
-
Filesize
20KB
MD51319e9998cedc513c68fa6d590b6ad63
SHA1ae95b333e88a13886994f320f5dfb4856168a710
SHA2569a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb
SHA512d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f