Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe
Resource
win10v2004-20220812-en
General
-
Target
90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe
-
Size
140KB
-
MD5
a28879e242248d3868b6a5da8c972e69
-
SHA1
865b6f731ad1eec562f67a0946100a2e79c57c3b
-
SHA256
90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c
-
SHA512
edcba61c228c683adcd2f4da6df04788dd5a5300c2bb0c8bbf1f3b58166b8323bc839e12436faf5f8954aa5d2bbcc41b63d5818066216a750de8c25f8477de90
-
SSDEEP
1536:UnM12OVLjlevyaRLBnLuRgiaZxRIxecePKH56Hdb+F:bPLpeTLlamiaZxRIxecePKyc
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Executes dropped EXE 1 IoCs
pid Process 3716 inl653F.tmp -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 5096 attrib.exe 4480 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\winzip\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: cmd.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe File opened for modification C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993576" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993576" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu5555.site\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3508453106" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu5555.site\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu5555.site\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993576" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3689078078" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3508453106" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu5555.site IEXPLORE.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FEA7801B-589B-11ED-B696-F639923F7CA1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu5555.site IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?S" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?S" reg.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H) reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\winzip\\3.bat\"" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2312 iexplore.exe 2312 iexplore.exe 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 544 wrote to memory of 4828 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 89 PID 544 wrote to memory of 4828 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 89 PID 544 wrote to memory of 4828 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 89 PID 4828 wrote to memory of 792 4828 cmd.exe 91 PID 4828 wrote to memory of 792 4828 cmd.exe 91 PID 4828 wrote to memory of 792 4828 cmd.exe 91 PID 792 wrote to memory of 2312 792 cmd.exe 93 PID 792 wrote to memory of 2312 792 cmd.exe 93 PID 792 wrote to memory of 1224 792 cmd.exe 94 PID 792 wrote to memory of 1224 792 cmd.exe 94 PID 792 wrote to memory of 1224 792 cmd.exe 94 PID 792 wrote to memory of 4092 792 cmd.exe 95 PID 792 wrote to memory of 4092 792 cmd.exe 95 PID 792 wrote to memory of 4092 792 cmd.exe 95 PID 4092 wrote to memory of 1004 4092 cmd.exe 97 PID 4092 wrote to memory of 1004 4092 cmd.exe 97 PID 4092 wrote to memory of 1004 4092 cmd.exe 97 PID 4092 wrote to memory of 1816 4092 cmd.exe 98 PID 4092 wrote to memory of 1816 4092 cmd.exe 98 PID 4092 wrote to memory of 1816 4092 cmd.exe 98 PID 4092 wrote to memory of 3500 4092 cmd.exe 100 PID 4092 wrote to memory of 3500 4092 cmd.exe 100 PID 4092 wrote to memory of 3500 4092 cmd.exe 100 PID 544 wrote to memory of 3716 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 99 PID 544 wrote to memory of 3716 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 99 PID 544 wrote to memory of 3716 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 99 PID 4092 wrote to memory of 4712 4092 cmd.exe 101 PID 4092 wrote to memory of 4712 4092 cmd.exe 101 PID 4092 wrote to memory of 4712 4092 cmd.exe 101 PID 4092 wrote to memory of 1040 4092 cmd.exe 102 PID 4092 wrote to memory of 1040 4092 cmd.exe 102 PID 4092 wrote to memory of 1040 4092 cmd.exe 102 PID 2312 wrote to memory of 1756 2312 iexplore.exe 103 PID 2312 wrote to memory of 1756 2312 iexplore.exe 103 PID 2312 wrote to memory of 1756 2312 iexplore.exe 103 PID 4092 wrote to memory of 4480 4092 cmd.exe 104 PID 4092 wrote to memory of 4480 4092 cmd.exe 104 PID 4092 wrote to memory of 4480 4092 cmd.exe 104 PID 4092 wrote to memory of 5096 4092 cmd.exe 105 PID 4092 wrote to memory of 5096 4092 cmd.exe 105 PID 4092 wrote to memory of 5096 4092 cmd.exe 105 PID 4092 wrote to memory of 3020 4092 cmd.exe 106 PID 4092 wrote to memory of 3020 4092 cmd.exe 106 PID 4092 wrote to memory of 3020 4092 cmd.exe 106 PID 4092 wrote to memory of 2400 4092 cmd.exe 107 PID 4092 wrote to memory of 2400 4092 cmd.exe 107 PID 4092 wrote to memory of 2400 4092 cmd.exe 107 PID 3020 wrote to memory of 4416 3020 rundll32.exe 108 PID 3020 wrote to memory of 4416 3020 rundll32.exe 108 PID 3020 wrote to memory of 4416 3020 rundll32.exe 108 PID 4416 wrote to memory of 3156 4416 runonce.exe 109 PID 4416 wrote to memory of 3156 4416 runonce.exe 109 PID 4416 wrote to memory of 3156 4416 runonce.exe 109 PID 544 wrote to memory of 3532 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 111 PID 544 wrote to memory of 3532 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 111 PID 544 wrote to memory of 3532 544 90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe 111 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4480 attrib.exe 5096 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe"C:\Users\Admin\AppData\Local\Temp\90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\PROGRA~1\INTERN~1\iexplore.exeC:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?716284⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1756
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\1.inf4⤵PID:1224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\2.bat4⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1004
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1816
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?S"" /f5⤵PID:3500
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f5⤵
- Modifies registry class
PID:4712
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\winzip\3.bat""" /f5⤵
- Modifies registry class
PID:1040
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4480
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5096
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\2.inf5⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵PID:3156
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 D:\VolumeDH\inj.dat,MainLoad5⤵PID:2400
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inl653F.tmpC:\Users\Admin\AppData\Local\Temp\inl653F.tmp2⤵
- Executes dropped EXE
PID:3716
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\90B5F9~1.EXE > nul2⤵PID:3532
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD55ddb1febcd291eb59d3d67d24a05bfd0
SHA1fe957affe27cb991f332e7f5c86d3a15359bd3b9
SHA256ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb
SHA51262d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD529dc8d6f9cbe091f1e93625e45f23e02
SHA1e972166dee5a5746a9cec38de62acb47f36866bd
SHA256ff339efdccc6c5311e6e316f3a6e3525836b50538e9f5d3da9ec27674673b5b3
SHA512afe40bf8d356fa8c4fc53458dba013d9a7016249723570bbd1590aae74367381ebb56a3c8721d8345db60fdb581429b3c451a6829636acdbbb6c2197baf2c52b
-
Filesize
1KB
MD5ab301ff15c000838c221b76a00aecb93
SHA1a9bd18bb6340c7055fdb627d85bf6f90a48eca21
SHA2565df478abe9d623d2707ca39a73259cbe95da2c824d23ed44454f55c5d67e6884
SHA5120cb9e594bbd0d27f03a0553255a0b238243147154c2bfc07a2a915369153185003087e47cd582f84f0dad954ea508896cce1387f596604f93e47287fe46e42e7
-
Filesize
57.2MB
MD53daf9f8de52b29e7972ba492a98cd42e
SHA11e257e056ce96ad76cecc2189cd8b668360921fe
SHA25662db3a3bb1a217b3e0cd46053b2d0f169d08d8c1353a19ec2f09811f1686cb2a
SHA512141cecd8dda37ae533ae382a57a6982520e4d4e1171edb7e60c5f189a1ab2ed8210964628252d95fb35042a745c98e752e82e27e754531b4d3623695a90f1996
-
Filesize
57.2MB
MD53daf9f8de52b29e7972ba492a98cd42e
SHA11e257e056ce96ad76cecc2189cd8b668360921fe
SHA25662db3a3bb1a217b3e0cd46053b2d0f169d08d8c1353a19ec2f09811f1686cb2a
SHA512141cecd8dda37ae533ae382a57a6982520e4d4e1171edb7e60c5f189a1ab2ed8210964628252d95fb35042a745c98e752e82e27e754531b4d3623695a90f1996
-
Filesize
53B
MD59b41ad553fc0a87c014049dfede9e7fa
SHA1840b9c356ec59e65d33bae61c439b0abf11663bd
SHA256a4bd6b14aa9694ba74db5503576072036cd232d586b5e3dd3fe3dade84a67b5e
SHA5126de134478cd5052675cf936f3dc92fb823d72fc3d44c66f5d0755691481302f63cfe602dd7b492354487c9c5b692a09a404c1081265bb3676030cb43a64369b8
-
Filesize
2KB
MD5582695c0131019067973d3870c8c9bca
SHA1575da5536074707385418985375d6735fec7de77
SHA2564dd7bb56ca6f2e48cd57ceafcd79ff31c11ce2d474d777ee5c9e16c5bfbf3e9c
SHA512ea59965f427ca826734115290e42ed9a2b7db66853474a735c0add16b5e0f2e799fe7586aa2114443797d3ea02c09e36523d072dc12be38c9be5ddbab6083231
-
Filesize
410B
MD566a1f0147fed7ddd19e9bb7ff93705c5
SHA19d803c81ea2195617379b880b227892ba30b0bf6
SHA2564f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764
SHA512cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597
-
Filesize
3KB
MD52cc7ab0e0e60b07b036165b5359b4f29
SHA1ce5d46d531e37bb52ac4983c061963223b043052
SHA25652ed22e575304c981f0f44c771fdd7d4fe185ecfba4ff9e3ac24986686e58be9
SHA51235bb22bf0c253a0d099f6fbf92ebea36714a674459f7185bce8267aee79ddceeef010a86b3e0f5a1aa9af0d7d3843c4a905a171529e19472543c916b7c926746
-
Filesize
247B
MD5bf915cb73f6126d712c727039ad3d5e6
SHA173ff72a83711c90e45f8bd34505b3284fd2a870b
SHA2563fd8eeaededa0a76d36df51803c01fe328ba110702a625b28c25bc83f6ef5940
SHA512752387b92716e8e5296d24c532f16e17a955c8f02055c9fd66d4ff84c8f140d7f2a43cfbb4ff97bd5ba1eebc7fa0c215a9283a180a9598b1b413730d19db1957
-
Filesize
44KB
MD569509720f2e7eec902005695aa5ba00d
SHA1673df7e523392e250e2655976de688f7e6ba7985
SHA256cd35e68248dbc944d2683f46d24d67c81cac6bbcb13d5d49adb8c1af956efd69
SHA512a38f252167f90edaa7a130d1c5891105a7dc749b9b4350b29308823df6fc20ddc775485448f5da29a1f1f6909c5c3c7cdeeb4564ed10804a7fdcb72f41fcd1a9