Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
223s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 02:06
Static task
static1
Behavioral task
behavioral1
Sample
24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe
Resource
win10v2004-20220812-en
General
-
Target
24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe
-
Size
725KB
-
MD5
a2dfd457a2aa30671d19ba61d9f36060
-
SHA1
e8ee0b1eec7e5fd264fbdf6e81925b779a3a7495
-
SHA256
24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e
-
SHA512
7c09390d2ffa620e007e715803f192ce1af22029afb0645e2a487fabf4d5d1aeb4b34465fc9731bd82b88123948d3652d7fd158dc6ce71482a4cee505b9c4c76
-
SSDEEP
12288:FcSyKHAjTtHerfrcoqChfprOlkYRpufZwyV9mOAH1cpJVze1pZKO7erzduNGXfeR:Z4H5xChfpUaheUniXe/oNGXfe393Faa3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\mCkEAkQY\\cuIsoEwQ.exe," 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\mCkEAkQY\\cuIsoEwQ.exe," 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe -
Executes dropped EXE 8 IoCs
pid Process 1252 TWUAkcwM.exe 344 TWUAkcwM.exe 3524 cuIsoEwQ.exe 3912 WqQUIUQs.exe 3964 cuIsoEwQ.exe 3256 cuIsoEwQ.exe 2936 WqQUIUQs.exe 3628 cuIsoEwQ.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cuIsoEwQ.exe = "C:\\ProgramData\\mCkEAkQY\\cuIsoEwQ.exe" 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cuIsoEwQ.exe = "C:\\ProgramData\\mCkEAkQY\\cuIsoEwQ.exe" cuIsoEwQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cuIsoEwQ.exe = "C:\\ProgramData\\mCkEAkQY\\cuIsoEwQ.exe" cuIsoEwQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cuIsoEwQ.exe = "C:\\ProgramData\\mCkEAkQY\\cuIsoEwQ.exe" WqQUIUQs.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TWUAkcwM.exe = "C:\\Users\\Admin\\ZeocogcU\\TWUAkcwM.exe" 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TWUAkcwM.exe = "C:\\Users\\Admin\\ZeocogcU\\TWUAkcwM.exe" TWUAkcwM.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\ZeocogcU WqQUIUQs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\ZeocogcU\TWUAkcwM WqQUIUQs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 30 IoCs
pid Process 4052 reg.exe 3856 reg.exe 2816 reg.exe 4020 reg.exe 1944 reg.exe 4284 reg.exe 1812 reg.exe 2868 reg.exe 3652 reg.exe 4008 reg.exe 2284 reg.exe 4160 reg.exe 1280 reg.exe 1692 reg.exe 1980 reg.exe 3152 reg.exe 3820 reg.exe 1500 reg.exe 4060 reg.exe 2220 reg.exe 1956 reg.exe 5004 reg.exe 2000 reg.exe 4252 reg.exe 3316 reg.exe 2220 reg.exe 1524 reg.exe 1616 reg.exe 4704 reg.exe 1668 reg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 1252 TWUAkcwM.exe 1252 TWUAkcwM.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4404 wrote to memory of 4156 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 83 PID 4404 wrote to memory of 4156 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 83 PID 4404 wrote to memory of 4156 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 83 PID 4404 wrote to memory of 1252 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 84 PID 4404 wrote to memory of 1252 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 84 PID 4404 wrote to memory of 1252 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 84 PID 1252 wrote to memory of 344 1252 TWUAkcwM.exe 85 PID 1252 wrote to memory of 344 1252 TWUAkcwM.exe 85 PID 1252 wrote to memory of 344 1252 TWUAkcwM.exe 85 PID 4404 wrote to memory of 3524 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 86 PID 4404 wrote to memory of 3524 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 86 PID 4404 wrote to memory of 3524 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 86 PID 1252 wrote to memory of 3964 1252 TWUAkcwM.exe 88 PID 1252 wrote to memory of 3964 1252 TWUAkcwM.exe 88 PID 1252 wrote to memory of 3964 1252 TWUAkcwM.exe 88 PID 3524 wrote to memory of 3256 3524 cuIsoEwQ.exe 89 PID 3524 wrote to memory of 3256 3524 cuIsoEwQ.exe 89 PID 3524 wrote to memory of 3256 3524 cuIsoEwQ.exe 89 PID 3912 wrote to memory of 2936 3912 WqQUIUQs.exe 90 PID 3912 wrote to memory of 2936 3912 WqQUIUQs.exe 90 PID 3912 wrote to memory of 2936 3912 WqQUIUQs.exe 90 PID 3964 wrote to memory of 3628 3964 cuIsoEwQ.exe 91 PID 3964 wrote to memory of 3628 3964 cuIsoEwQ.exe 91 PID 3964 wrote to memory of 3628 3964 cuIsoEwQ.exe 91 PID 4404 wrote to memory of 1784 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 92 PID 4404 wrote to memory of 1784 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 92 PID 4404 wrote to memory of 1784 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 92 PID 1784 wrote to memory of 4388 1784 cmd.exe 94 PID 1784 wrote to memory of 4388 1784 cmd.exe 94 PID 1784 wrote to memory of 4388 1784 cmd.exe 94 PID 4404 wrote to memory of 1812 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 95 PID 4404 wrote to memory of 1812 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 95 PID 4404 wrote to memory of 1812 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 95 PID 4404 wrote to memory of 3152 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 96 PID 4404 wrote to memory of 3152 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 96 PID 4404 wrote to memory of 3152 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 96 PID 4404 wrote to memory of 1692 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 97 PID 4404 wrote to memory of 1692 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 97 PID 4404 wrote to memory of 1692 4404 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 97 PID 4388 wrote to memory of 4264 4388 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 98 PID 4388 wrote to memory of 4264 4388 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 98 PID 4388 wrote to memory of 4264 4388 24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe"C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY2⤵PID:4156
-
-
C:\Users\Admin\ZeocogcU\TWUAkcwM.exe"C:\Users\Admin\ZeocogcU\TWUAkcwM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\ZeocogcU\TWUAkcwM.exeRTUX3⤵
- Executes dropped EXE
PID:344
-
-
C:\ProgramData\mCkEAkQY\cuIsoEwQ.exe"C:\ProgramData\mCkEAkQY\cuIsoEwQ.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\ProgramData\mCkEAkQY\cuIsoEwQ.exeWYZK4⤵
- Executes dropped EXE
PID:3628
-
-
-
-
C:\ProgramData\mCkEAkQY\cuIsoEwQ.exe"C:\ProgramData\mCkEAkQY\cuIsoEwQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\ProgramData\mCkEAkQY\cuIsoEwQ.exeWYZK3⤵
- Executes dropped EXE
PID:3256
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e3⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY4⤵PID:4264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"4⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e5⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY6⤵PID:2976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"6⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e7⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY8⤵PID:4444
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"8⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e9⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY10⤵PID:1468
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"10⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e11⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY12⤵PID:4516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"12⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e13⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY14⤵PID:968
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"14⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e15⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY16⤵PID:2268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"16⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e17⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY18⤵PID:3084
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"18⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e19⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY20⤵PID:1060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e"20⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exeC:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e21⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6e.exePSWY22⤵PID:1696
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- Modifies registry key
PID:2220
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
PID:4252
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies registry key
PID:1956
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies registry key
PID:4052
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
PID:1280
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- Modifies registry key
PID:2284
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies registry key
PID:4284
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
PID:1668
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- Modifies registry key
PID:3316
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies registry key
PID:1616
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
PID:4704
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- Modifies registry key
PID:1980
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies registry key
PID:4008
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- Modifies registry key
PID:1944
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
PID:2000
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies registry key
PID:2816
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
PID:3652
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- Modifies registry key
PID:4020
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies registry key
PID:4160
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
PID:5004
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- Modifies registry key
PID:4060
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
PID:3820
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
PID:3856
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- Modifies registry key
PID:2868
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies registry key
PID:2220
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
PID:1524
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
PID:1500
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:1812
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:3152
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:1692
-
-
C:\ProgramData\iOEoUcIw\WqQUIUQs.exeC:\ProgramData\iOEoUcIw\WqQUIUQs.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\ProgramData\iOEoUcIw\WqQUIUQs.exeWYMG2⤵
- Executes dropped EXE
PID:2936
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2152
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714KB
MD586a37a5abbb336e4b1e6490dac24ca67
SHA1ce7848d527ea9c91d595e29aec01dee3700df84a
SHA256c19a46cf05ae2b4062676cf11e2464a69158764dcc72511344534f05b5fc3fea
SHA5123c8fb13b903ad110a0ac1afd703fe5eb747783418e3e2ce7b4564769214399abdbd08d399720b2c5df82912cd64f5d9ba90cf26287d256574fa97aca444b29ed
-
Filesize
714KB
MD586a37a5abbb336e4b1e6490dac24ca67
SHA1ce7848d527ea9c91d595e29aec01dee3700df84a
SHA256c19a46cf05ae2b4062676cf11e2464a69158764dcc72511344534f05b5fc3fea
SHA5123c8fb13b903ad110a0ac1afd703fe5eb747783418e3e2ce7b4564769214399abdbd08d399720b2c5df82912cd64f5d9ba90cf26287d256574fa97aca444b29ed
-
Filesize
714KB
MD586a37a5abbb336e4b1e6490dac24ca67
SHA1ce7848d527ea9c91d595e29aec01dee3700df84a
SHA256c19a46cf05ae2b4062676cf11e2464a69158764dcc72511344534f05b5fc3fea
SHA5123c8fb13b903ad110a0ac1afd703fe5eb747783418e3e2ce7b4564769214399abdbd08d399720b2c5df82912cd64f5d9ba90cf26287d256574fa97aca444b29ed
-
Filesize
4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
Filesize
714KB
MD5e788168aa3ca862bfea158b59b899dee
SHA16c8e0ade0f7ba576af8310ad2886a041b0162447
SHA25605a85a5183ae9198f39104687596304e7999a5bc2a9df46fe5ce81dced142261
SHA512451032aeaa1d014b6cce111090ddbdb31b471b6a9c21287f8b106fe9daa3b3b5d22ae925e46f1766d4c5df85ada9fc1080db85f139fca471d1a3e97c82299009
-
Filesize
714KB
MD5e788168aa3ca862bfea158b59b899dee
SHA16c8e0ade0f7ba576af8310ad2886a041b0162447
SHA25605a85a5183ae9198f39104687596304e7999a5bc2a9df46fe5ce81dced142261
SHA512451032aeaa1d014b6cce111090ddbdb31b471b6a9c21287f8b106fe9daa3b3b5d22ae925e46f1766d4c5df85ada9fc1080db85f139fca471d1a3e97c82299009
-
Filesize
714KB
MD5e788168aa3ca862bfea158b59b899dee
SHA16c8e0ade0f7ba576af8310ad2886a041b0162447
SHA25605a85a5183ae9198f39104687596304e7999a5bc2a9df46fe5ce81dced142261
SHA512451032aeaa1d014b6cce111090ddbdb31b471b6a9c21287f8b106fe9daa3b3b5d22ae925e46f1766d4c5df85ada9fc1080db85f139fca471d1a3e97c82299009
-
Filesize
714KB
MD5e788168aa3ca862bfea158b59b899dee
SHA16c8e0ade0f7ba576af8310ad2886a041b0162447
SHA25605a85a5183ae9198f39104687596304e7999a5bc2a9df46fe5ce81dced142261
SHA512451032aeaa1d014b6cce111090ddbdb31b471b6a9c21287f8b106fe9daa3b3b5d22ae925e46f1766d4c5df85ada9fc1080db85f139fca471d1a3e97c82299009
-
Filesize
714KB
MD5e788168aa3ca862bfea158b59b899dee
SHA16c8e0ade0f7ba576af8310ad2886a041b0162447
SHA25605a85a5183ae9198f39104687596304e7999a5bc2a9df46fe5ce81dced142261
SHA512451032aeaa1d014b6cce111090ddbdb31b471b6a9c21287f8b106fe9daa3b3b5d22ae925e46f1766d4c5df85ada9fc1080db85f139fca471d1a3e97c82299009
-
Filesize
4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
Filesize
4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
Filesize
6KB
MD58d59f5f3929b07ccae9ff4d9c238ff7d
SHA1f8cf4e4edddb2335c6868295456eb9092e42a1d5
SHA256075adc45d321bd8b0562bd8df87febe1c0991224b9d00363550a7345de8522db
SHA5121cc4e3dfc9c6bd6e7d368d1401b74224162d0597b85cfb06fa671bae31a4e1ce9659f0caf72f3bf16f2fd61437a685cfc7cdf0b5524ff078a5a888644f5f1809
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
C:\Users\Admin\AppData\Local\Temp\24f24e0d301c497421da5b326fad07b25ed8119af370b44c0d9dfa42ccd3df6ePSWY
Filesize4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232
-
Filesize
714KB
MD5c09cb522b0df2f53bda4b5568a22feb3
SHA1e6857cb6f72c3ec108373bc0350788f89b6ee8cd
SHA256558b22f19212bb815ccd4db5a919943951a382370e28e9d589999d6d5aeb4caf
SHA512497377e14512bfbcaa6e41cd7c109d4a64d3d191214025e4e354e07cb35e357a50d5f16063c4aad18c481e7c40b28d26072fd4e279b331fb224f3dc047948a03
-
Filesize
714KB
MD5c09cb522b0df2f53bda4b5568a22feb3
SHA1e6857cb6f72c3ec108373bc0350788f89b6ee8cd
SHA256558b22f19212bb815ccd4db5a919943951a382370e28e9d589999d6d5aeb4caf
SHA512497377e14512bfbcaa6e41cd7c109d4a64d3d191214025e4e354e07cb35e357a50d5f16063c4aad18c481e7c40b28d26072fd4e279b331fb224f3dc047948a03
-
Filesize
714KB
MD5c09cb522b0df2f53bda4b5568a22feb3
SHA1e6857cb6f72c3ec108373bc0350788f89b6ee8cd
SHA256558b22f19212bb815ccd4db5a919943951a382370e28e9d589999d6d5aeb4caf
SHA512497377e14512bfbcaa6e41cd7c109d4a64d3d191214025e4e354e07cb35e357a50d5f16063c4aad18c481e7c40b28d26072fd4e279b331fb224f3dc047948a03
-
Filesize
4B
MD59134669f44c1af0532f613b7508283c4
SHA11c2ac638c61bcdbc434fc74649e281bcb1381da2
SHA2567273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2
SHA512ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232