Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
77s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe
-
Size
746KB
-
MD5
1a1edddace03ddef321c864e150785d1
-
SHA1
fc36161ff998afd44fd15f82c94a48a60ff6a801
-
SHA256
23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987
-
SHA512
2840795eb0961c89db8c87d316cb43a2f94467452868bbfd9ccf06e9d18cf3e6f42eb59eafbbcaaff7962131b66e5e3d74e7df7ac336210e7dd41b1f0956d516
-
SSDEEP
6144:a+nglw9ayQv3ahvyn/PU7O0KXgTTSj9ltfgIg+oaAhIXbO9qsWSM:rjS3Yvyn/0TkLFYsqTM
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe -
Executes dropped EXE 1 IoCs
pid Process 1300 01133.exe -
Loads dropped DLL 4 IoCs
pid Process 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 1300 01133.exe 1300 01133.exe 1300 01133.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\system32\\svchost.exe" reg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\freizer = "C:\\WINDOWS\\system32\\freizer.exe" reg.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundll32.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\autofmt.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\efsui.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\cacls.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\DisplaySwitch.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\net.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\net1.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\ocsetup.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\print.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\printui.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\com\MigRegDB.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\winrs.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\msdt.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\timeout.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\vssadmin.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\xlog.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPUEX.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\psr.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\xpsrchvw.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\com\comrepl.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\logagent.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\at.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\instnm.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\netsh.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\SysWOW64\sort.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\7-Zip\7z.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMC.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_6.1.7601.17514_none_6fb51b358e21d75f\TabTip.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-xcopy_31bf3856ad364e35_6.1.7600.16385_none_beea9c500dfd4622\xcopy.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7\ntoskrnl.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7601.17514_none_c90e996c4aa655c4\Robocopy.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\HelpPane.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.16385_none_1c98ed5d08db04ce\Mahjong.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\shrpubw.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-secinit_31bf3856ad364e35_6.1.7600.16385_none_878e469b2e51ce80\secinit.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-wusa_31bf3856ad364e35_6.1.7601.17514_none_af07fb6876def437\wusa.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_6.1.7600.16385_none_c8897566b5c070a0\InfDefaultInstall.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7601.17514_none_3d9977977190cdc4\tabcal.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_2d1a84c49beb2055\wiaacmgr.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-at_31bf3856ad364e35_6.1.7600.16385_none_4cd7fa8ce5381b26\at.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\relog.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_0c2c92921b2478ef\regini.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_6.1.7601.17514_none_0b0882245933a065\nfsclnt.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedt32.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\msil_jsc_b03f5f7f11d50a3a_6.1.7600.16385_none_7c5b469993c3ad32\jsc.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\icsunattend.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_7addf2001d014646\dpnsvr.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-timeout_31bf3856ad364e35_6.1.7600.16385_none_8c3ac2e4279846be\timeout.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_1ddb4b87a6618437\chkdsk.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.1.7600.16385_none_7547f48c79b40229\msdtc.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_6f74b7d163601da2\DevicePairingWizard.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-eventlog-commandline_31bf3856ad364e35_6.1.7600.16385_none_c0aa8bc2de239cf9\wevtutil.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ftp_31bf3856ad364e35_6.1.7601.17514_none_aef2c7dbb6cc16c1\ftp.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_1c140627131a6df3\mcbuilder.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_03d0d3c435b27637\clip.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_bd4644e077251730\cmstp.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_b9c82ac6f7db99ae\where.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_narrator-nonmsil_31bf3856ad364e35_6.1.7601.17514_none_8b63c5e0db87fde8\Narrator.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728\printui.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-netplwiz-exe_31bf3856ad364e35_6.1.7600.16385_none_ed2d0ae971b57e8d\Netplwiz.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_17dbc2dd2d2552c7\verclsid.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.2.9600.16428_none_1c0dbd69636d746a\ieUnatt.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_dafff0c26538f91f\extrac32.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9\ntoskrnl.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..yer-sideshow-gadget_31bf3856ad364e35_6.1.7600.16385_none_841e9494c8a32794\WMPSideShowGadget.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_11.2.9600.16428_none_eace14b8d6178cca\SetIEInstalledDate.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.2.9600.16428_none_8cae83b0cdeb7a9b\ielowutil.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_96421d40c0e2903e\aspnet_regbrowsers.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_8fbb77bb3cd808d1\pcalua.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_ae214da780801b0f\RegisterIEPKEYs.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\logman.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_b70694aa97134f37\rdrleakdiag.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_6.1.7601.17514_none_326571587836a400\wsqmcons.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00\mpnotify.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_aeb1ef0f4e6bba1d\wscript.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-fdddo_31bf3856ad364e35_6.1.7600.16385_none_b0de2afe4ca7a1e2\DeviceDisplayObjectProvider.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_58326e688d4907c6\WFServicesReg.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6\hh.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-timeout_31bf3856ad364e35_6.1.7600.16385_none_e8595e67dff5b7f4\timeout.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_6.1.7601.17514_none_b656fd566c17dc3a\mstsc.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\iexpress.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_b1186146f739d0f1\forfiles.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_0a026c46104dd379\msinfo32.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2\recdisc.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7601.17514_none_13305696250bcb70\WPDShextAutoplay.exe 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1776 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 28 PID 2036 wrote to memory of 1776 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 28 PID 2036 wrote to memory of 1776 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 28 PID 2036 wrote to memory of 1776 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 28 PID 2036 wrote to memory of 892 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 29 PID 2036 wrote to memory of 892 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 29 PID 2036 wrote to memory of 892 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 29 PID 2036 wrote to memory of 892 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 29 PID 1776 wrote to memory of 1564 1776 cmd.exe 32 PID 1776 wrote to memory of 1564 1776 cmd.exe 32 PID 1776 wrote to memory of 1564 1776 cmd.exe 32 PID 1776 wrote to memory of 1564 1776 cmd.exe 32 PID 892 wrote to memory of 1748 892 cmd.exe 33 PID 892 wrote to memory of 1748 892 cmd.exe 33 PID 892 wrote to memory of 1748 892 cmd.exe 33 PID 892 wrote to memory of 1748 892 cmd.exe 33 PID 2036 wrote to memory of 1300 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 34 PID 2036 wrote to memory of 1300 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 34 PID 2036 wrote to memory of 1300 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 34 PID 2036 wrote to memory of 1300 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 34 PID 2036 wrote to memory of 1300 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 34 PID 2036 wrote to memory of 1300 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 34 PID 2036 wrote to memory of 1300 2036 23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe"C:\Users\Admin\AppData\Local\Temp\23ed589b5e30005891dc957cad1efb9df5587512d820b0ed6d9c9cf958a39987.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f3⤵
- Adds Run key to start application
PID:1564
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f3⤵
- Adds Run key to start application
PID:1748
-
-
-
C:\windows\temp\01133.exe"C:\windows\temp\01133.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD55ff1667abbd26132c3e2784f3c16878e
SHA13e9db39bddb6abad25193633e206c57046e8524e
SHA2568663e8ee4644dfd0fcfac08218092fcc5eeea4a2d55a55bccaca0ab2e70bc65c
SHA5125745a57ae14f3a27db41066895d137418ded8291fd5d33e819ac6cb865c80c2947bb52bec41305bf375606ded11a4d7ad9397cb7fc177b8fdba09d0b8818e60e
-
Filesize
11KB
MD55ff1667abbd26132c3e2784f3c16878e
SHA13e9db39bddb6abad25193633e206c57046e8524e
SHA2568663e8ee4644dfd0fcfac08218092fcc5eeea4a2d55a55bccaca0ab2e70bc65c
SHA5125745a57ae14f3a27db41066895d137418ded8291fd5d33e819ac6cb865c80c2947bb52bec41305bf375606ded11a4d7ad9397cb7fc177b8fdba09d0b8818e60e
-
Filesize
11KB
MD55ff1667abbd26132c3e2784f3c16878e
SHA13e9db39bddb6abad25193633e206c57046e8524e
SHA2568663e8ee4644dfd0fcfac08218092fcc5eeea4a2d55a55bccaca0ab2e70bc65c
SHA5125745a57ae14f3a27db41066895d137418ded8291fd5d33e819ac6cb865c80c2947bb52bec41305bf375606ded11a4d7ad9397cb7fc177b8fdba09d0b8818e60e
-
Filesize
11KB
MD55ff1667abbd26132c3e2784f3c16878e
SHA13e9db39bddb6abad25193633e206c57046e8524e
SHA2568663e8ee4644dfd0fcfac08218092fcc5eeea4a2d55a55bccaca0ab2e70bc65c
SHA5125745a57ae14f3a27db41066895d137418ded8291fd5d33e819ac6cb865c80c2947bb52bec41305bf375606ded11a4d7ad9397cb7fc177b8fdba09d0b8818e60e
-
Filesize
11KB
MD55ff1667abbd26132c3e2784f3c16878e
SHA13e9db39bddb6abad25193633e206c57046e8524e
SHA2568663e8ee4644dfd0fcfac08218092fcc5eeea4a2d55a55bccaca0ab2e70bc65c
SHA5125745a57ae14f3a27db41066895d137418ded8291fd5d33e819ac6cb865c80c2947bb52bec41305bf375606ded11a4d7ad9397cb7fc177b8fdba09d0b8818e60e
-
Filesize
11KB
MD55ff1667abbd26132c3e2784f3c16878e
SHA13e9db39bddb6abad25193633e206c57046e8524e
SHA2568663e8ee4644dfd0fcfac08218092fcc5eeea4a2d55a55bccaca0ab2e70bc65c
SHA5125745a57ae14f3a27db41066895d137418ded8291fd5d33e819ac6cb865c80c2947bb52bec41305bf375606ded11a4d7ad9397cb7fc177b8fdba09d0b8818e60e