Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe
Resource
win10v2004-20220901-en
General
-
Target
aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe
-
Size
168KB
-
MD5
928d6b6564191339000ffd9c19ea9d3a
-
SHA1
cf3aebdc96d78f638fe154ad2dc00dfb3dff91be
-
SHA256
aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98
-
SHA512
6b14c89f8afdf13632c9dec2e76aa8333a6d3143c08b25dd94d52a2cc515b5e69ebb94652cb7bb115bb07aab400abf2d36d6239e5a7cb1cc426e85eb6bf9f805
-
SSDEEP
1536:aHob+TnkkpRNGojAbnXlkjZ2G+7ErBnOZn2KcGO3Ekm+7UmNhG6n3+s:sOukkJGoEbXldaE5eAK
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Executes dropped EXE 1 IoCs
pid Process 2412 inl2E73.tmp -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1300 attrib.exe 1148 attrib.exe -
Deletes itself 1 IoCs
pid Process 2612 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1652 aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe 1652 aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe File opened for modification C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "189" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8EB7FEA1-58A0-11ED-979E-6A94EDCEDC7A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu1111.site IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu1111.site\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu1111.site\Total = "63" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu1111.site\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu1111.site IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main reg.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.82133.com/?o" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?o" reg.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H) reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\"" reg.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 1872 rundll32.exe Token: SeRestorePrivilege 1872 rundll32.exe Token: SeRestorePrivilege 1872 rundll32.exe Token: SeRestorePrivilege 1872 rundll32.exe Token: SeRestorePrivilege 1872 rundll32.exe Token: SeRestorePrivilege 1872 rundll32.exe Token: SeRestorePrivilege 1872 rundll32.exe Token: SeRestorePrivilege 1084 rundll32.exe Token: SeRestorePrivilege 1084 rundll32.exe Token: SeRestorePrivilege 1084 rundll32.exe Token: SeRestorePrivilege 1084 rundll32.exe Token: SeRestorePrivilege 1084 rundll32.exe Token: SeRestorePrivilege 1084 rundll32.exe Token: SeRestorePrivilege 1084 rundll32.exe Token: SeIncBasePriorityPrivilege 1652 aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 776 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 776 iexplore.exe 776 iexplore.exe 1208 IEXPLORE.EXE 1208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 684 1652 aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe 30 PID 1652 wrote to memory of 684 1652 aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe 30 PID 1652 wrote to memory of 684 1652 aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe 30 PID 1652 wrote to memory of 684 1652 aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe 30 PID 684 wrote to memory of 1116 684 cmd.exe 32 PID 684 wrote to memory of 1116 684 cmd.exe 32 PID 684 wrote to memory of 1116 684 cmd.exe 32 PID 684 wrote to memory of 1116 684 cmd.exe 32 PID 1116 wrote to memory of 776 1116 cmd.exe 34 PID 1116 wrote to memory of 776 1116 cmd.exe 34 PID 1116 wrote to memory of 776 1116 cmd.exe 34 PID 1116 wrote to memory of 776 1116 cmd.exe 34 PID 1116 wrote to memory of 1872 1116 cmd.exe 35 PID 1116 wrote to memory of 1872 1116 cmd.exe 35 PID 1116 wrote to memory of 1872 1116 cmd.exe 35 PID 1116 wrote to memory of 1872 1116 cmd.exe 35 PID 1116 wrote to memory of 1872 1116 cmd.exe 35 PID 1116 wrote to memory of 1872 1116 cmd.exe 35 PID 1116 wrote to memory of 1872 1116 cmd.exe 35 PID 1116 wrote to memory of 828 1116 cmd.exe 36 PID 1116 wrote to memory of 828 1116 cmd.exe 36 PID 1116 wrote to memory of 828 1116 cmd.exe 36 PID 1116 wrote to memory of 828 1116 cmd.exe 36 PID 776 wrote to memory of 1208 776 iexplore.exe 38 PID 776 wrote to memory of 1208 776 iexplore.exe 38 PID 776 wrote to memory of 1208 776 iexplore.exe 38 PID 776 wrote to memory of 1208 776 iexplore.exe 38 PID 828 wrote to memory of 1284 828 cmd.exe 39 PID 828 wrote to memory of 1284 828 cmd.exe 39 PID 828 wrote to memory of 1284 828 cmd.exe 39 PID 828 wrote to memory of 1284 828 cmd.exe 39 PID 828 wrote to memory of 1792 828 cmd.exe 40 PID 828 wrote to memory of 1792 828 cmd.exe 40 PID 828 wrote to memory of 1792 828 cmd.exe 40 PID 828 wrote to memory of 1792 828 cmd.exe 40 PID 828 wrote to memory of 1460 828 cmd.exe 41 PID 828 wrote to memory of 1460 828 cmd.exe 41 PID 828 wrote to memory of 1460 828 cmd.exe 41 PID 828 wrote to memory of 1460 828 cmd.exe 41 PID 828 wrote to memory of 888 828 cmd.exe 42 PID 828 wrote to memory of 888 828 cmd.exe 42 PID 828 wrote to memory of 888 828 cmd.exe 42 PID 828 wrote to memory of 888 828 cmd.exe 42 PID 828 wrote to memory of 1516 828 cmd.exe 43 PID 828 wrote to memory of 1516 828 cmd.exe 43 PID 828 wrote to memory of 1516 828 cmd.exe 43 PID 828 wrote to memory of 1516 828 cmd.exe 43 PID 828 wrote to memory of 1300 828 cmd.exe 44 PID 828 wrote to memory of 1300 828 cmd.exe 44 PID 828 wrote to memory of 1300 828 cmd.exe 44 PID 828 wrote to memory of 1300 828 cmd.exe 44 PID 828 wrote to memory of 1148 828 cmd.exe 45 PID 828 wrote to memory of 1148 828 cmd.exe 45 PID 828 wrote to memory of 1148 828 cmd.exe 45 PID 828 wrote to memory of 1148 828 cmd.exe 45 PID 828 wrote to memory of 1084 828 cmd.exe 46 PID 828 wrote to memory of 1084 828 cmd.exe 46 PID 828 wrote to memory of 1084 828 cmd.exe 46 PID 828 wrote to memory of 1084 828 cmd.exe 46 PID 828 wrote to memory of 1084 828 cmd.exe 46 PID 828 wrote to memory of 1084 828 cmd.exe 46 PID 828 wrote to memory of 1084 828 cmd.exe 46 PID 828 wrote to memory of 1020 828 cmd.exe 47 PID 828 wrote to memory of 1020 828 cmd.exe 47 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1300 attrib.exe 1148 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe"C:\Users\Admin\AppData\Local\Temp\aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\teacher2011_check.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\PROGRA~1\INTERN~1\iexplore.exeC:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?821334⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1208
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf4⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat4⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1284
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1792
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?o"" /f5⤵PID:1460
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f5⤵
- Modifies registry class
PID:888
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f5⤵
- Modifies registry class
PID:1516
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1300
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1148
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf5⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1084 -
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
PID:1596 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵PID:1212
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 D:\VolumeDH\inj.dat,MainLoad5⤵PID:1020
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inl2E73.tmpC:\Users\Admin\AppData\Local\Temp\inl2E73.tmp2⤵
- Executes dropped EXE
PID:2412
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AAB4E5~1.EXE > nul2⤵
- Deletes itself
PID:2612
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD53dcf580a93972319e82cafbc047d34d5
SHA18528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA25640810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
SHA51298384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fe16a33709401b53939139c446ac5ea
SHA117492a89d33168432feb107134cd9e125b10a7ad
SHA25640c9d58392e82ce445d1f6692e7b7db82941747e484732f46fe15ca8f2621a9f
SHA5120becaa6fca79b5cb702de6f80fd6a22c4d5123156fc0bb257294b88a0697ea8005a6dba3808b611e58a8d597da2a28d4cde9d73da62db2d88c8a6a06d40aa376
-
Filesize
5KB
MD5f60ad1abd3157ceba5e0cdd820d33b96
SHA19c02253418a338d11367954b22dc35634911c228
SHA2567bb6ef5505b7ef0f84392177d768ee1d71e67ca5e66a35c7726a97bdcbc3df16
SHA5128e093fb61818bed1254a16ae89bfe855fa516c57cb9b6f5eafbe629f5fd5e14e0c83252e53802251a734885858e5fe3e5487ef94729e26948ac11eb410143610
-
Filesize
114.1MB
MD57cde9b109a70a2194dc360f07fc37907
SHA1aefba29edf70c582876db3a14f5805acc39a61ac
SHA25612ca514916872f5168bbe89e3e499201111bd3e5418afdbcdccb5d8302524d3e
SHA5127ffdd157aefff1fda388e22d8d30f9a34a2acb90d92f5eb7489284372f29c2a9bd35b8117b841c054f5d34125c619d39b390c56ffac338cb97d7dc53bc1ceeb2
-
Filesize
53B
MD523962a245f75fe25510051582203aff1
SHA120832a3a1179bb2730194d2f7738d41d5d669a43
SHA2561abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647
SHA512dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80
-
Filesize
660B
MD5c40ea8f677b3f48bfb7f4cfc6d3f03ab
SHA110b94afd8e6ea98a3c8a955304f9ce660b0c380a
SHA256b1a31a74cc88d0f8e39aaebf58a724b89391dc3fbac733953790edf8ded8172c
SHA512409b8a45576bf08e185446b13a512c115df7483ff8ec30ea51ee93ee1ac8153ae3b615650ff69a5d1e41fa0cd57fcdc4c5d03b4b4453431114ac018f48e194d9
-
Filesize
608B
MD522606620b4d462c5012039f7892afc29
SHA141f7b78324b66a98eca6f0826737cb7afbd292de
SHA256c7d61af774e6bcdc8cffdec278f212da2cc79c89d68c689d53c40b6478df0f57
SHA51280db4f72ad1ccf80bf78bb31b3f101ab88961471a62f1ddae071b8279edc9233421697f3537bb60cb94213c569979875740bd9d7bc33aa1171b1f22fdd0ca84c
-
Filesize
3KB
MD5b7c5e3b416b1d1b5541ef44662e1a764
SHA18bff7ea2be2f3cf29f2381d8007198b5991ca3ae
SHA256f1a2f9fdebb3cac24756e53fa5e1628b2bd1cc130480c1878e3b3bc880575cd1
SHA51265dbd6a7a7cf6fec00e6b0f1d7d5655769e6087ad09cad74c91c5a3395e675ac8f9df5c7185327e6f8dd03ddb60504400f54237d9e4b53c8b08e7e3d41ee61fc
-
Filesize
492B
MD534c14b8530e1094e792527f7a474fe77
SHA1f71c4e9091140256b34c18220d1dd1efab1f301d
SHA256fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713
SHA51225bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2
-
Filesize
3KB
MD56b78cb8ced798ca5df5612dd62ce0965
SHA15a9c299393b96b0bf8f6770e3c7b0318a9e2e0cf
SHA25681f64f42edfac2863a55db8fabd528c4eefc67f7e658cad6a57eeec862e444e3
SHA512b387ba10021f3284d1406d520a2c8b3ba0c87922d67c79394c1aa50c631194519ac6bb5b898956533f040d48e1c7b202734e0075f8fc8c8bfab82c8ef359b28e
-
Filesize
247B
MD5ca436f6f187bc049f9271ecdcbf348fa
SHA1bf8a548071cfc150f7affb802538edf03d281106
SHA2566cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534
SHA512d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591
-
Filesize
12.3MB
MD5878e21036cd106c25d9c9e351a807f0a
SHA13238ac0d42a8be7e35909732b49435efd26589f0
SHA256825ad3e3421c4fdf026299c5d7002ffe953d725e909aa2dee3ff32febb45788a
SHA512dd4581133b44ae676bf1094ab0ccc7eed271a3d6236797102a99fab65756b50ba8ede5a6f20edeb1ce04bca26860b48eb48647a1f82e85cd426dcf8aa9bb8b35
-
Filesize
117.1MB
MD56e0f0e3a21f65eee32da1dd2d5755633
SHA1955480858996ea06d71b193a3e28415093594e68
SHA256d6103111c6845c82231640297a0f974c35178e33b48999d68f0662ef80194133
SHA5123044d1aa786d487becec84c72c8b2f0a32b6feb46415ab74b4613edaf440ae2ab584d60b9bc184c5c61cccfd414b87b4e84ddb2631c14dcac58f4d0661536bd4
-
Filesize
110.6MB
MD5fa931f31f009320d46c1ca12ea5dedbe
SHA11cf8d1383b3bda669f09e8412ad195a8ce626719
SHA2568c1c3b137a79971bc07a27b75cb0745d2a5b354a086263ac22ec7ab7e5de06f2
SHA51247a216d4519b960c13c600dd3dc1ab283b10dce7aad0de0d392d271ae58d18771c84730b11d7c8da2440f0e138fe6d9815370118aea34d575688cbac26e8fdb7