Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
211s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 16:13
Behavioral task
behavioral1
Sample
827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe
-
Size
800KB
-
MD5
0805d96eb2c3d5122f32d5a822344b00
-
SHA1
dfdc48badbaf9308b4f39883142e124b419e980a
-
SHA256
827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9
-
SHA512
65a6a1a328f31ffb30a23b7e5c904c167b681bd42cb3cffce6b827095984eac57e61c5106f0b601844a5f5dd4d6aea0b0242ca74cb7f2814d9e70e0de8e51076
-
SSDEEP
6144:PTBcx19YgC8Ukq9NXcHNINzsr5IW4Fxpr7dTHbmdUnmXr3w798r4:PTB09SkkNXKgor5IWk3rkegrO
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe rundll.exe" 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral1/memory/1908-55-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral1/memory/1908-62-0x0000000000400000-0x0000000000535000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\regsvr.exe" 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\n: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\p: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\t: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\h: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\l: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\z: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\k: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\e: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\f: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\j: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\r: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\u: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\v: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\b: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\g: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\m: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\o: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\q: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\s: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\w: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\x: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\a: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened (read-only) \??\y: 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\system = "Winhelp.exe" 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1908-55-0x0000000000400000-0x0000000000535000-memory.dmp autoit_exe behavioral1/memory/1908-62-0x0000000000400000-0x0000000000535000-memory.dmp autoit_exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr.exe 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened for modification C:\Windows\SysWOW64\regsvr.exe 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File created C:\Windows\SysWOW64\winhelp.exe 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened for modification C:\Windows\SysWOW64\winhelp.exe 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened for modification C:\Windows\SysWOW64\setup.ini 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\regsvr.exe 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened for modification C:\Windows\regsvr.exe 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File created C:\Windows\winhelp.ini 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe File opened for modification C:\Windows\winhelp.ini 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1292 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 28 PID 1908 wrote to memory of 1292 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 28 PID 1908 wrote to memory of 1292 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 28 PID 1908 wrote to memory of 1292 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 28 PID 1292 wrote to memory of 1116 1292 cmd.exe 30 PID 1292 wrote to memory of 1116 1292 cmd.exe 30 PID 1292 wrote to memory of 1116 1292 cmd.exe 30 PID 1292 wrote to memory of 1116 1292 cmd.exe 30 PID 1908 wrote to memory of 904 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 31 PID 1908 wrote to memory of 904 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 31 PID 1908 wrote to memory of 904 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 31 PID 1908 wrote to memory of 904 1908 827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe 31 PID 904 wrote to memory of 772 904 cmd.exe 33 PID 904 wrote to memory of 772 904 cmd.exe 33 PID 904 wrote to memory of 772 904 cmd.exe 33 PID 904 wrote to memory of 772 904 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe"C:\Users\Admin\AppData\Local\Temp\827563c552eabaf7a926e0ee854db8fbf854dc91c2094e1a0d24d87ea57255b9.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:1116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winhelp.exe2⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winhelp.exe3⤵PID:772
-
-