Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe
Resource
win10v2004-20220812-en
Errors
General
-
Target
43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe
-
Size
790KB
-
MD5
5578387f06f400080bde5edffb916326
-
SHA1
e7314811b374b84b703fbd13bfed773c2f122c48
-
SHA256
43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f
-
SHA512
3694a0a8315e854f9bea7fc4f2641087f8a84981b1b68e3088fa63ebec76c85e2df67d634af97796315b87c108a3f898ea73dba1116bf45f8d6403fd9c24a7fe
-
SSDEEP
3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5108 created 672 5108 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat 74 -
Adds policy Run key to start application 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\\RoamingState\\6CVbNlPc5HHepcWgcU0TcMy9n5JP60kzaJC5Smtx0TSpee2qSMSxTBjtbekqxZ2UeImTi.exe\" O" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AppData\\e6TB0gPCjLRmDT9DNUK7iV7Oajkkj.exe\" O" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\cy-GB\\wWsIRSs9jpenucL.exe\" O" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\y1W6ZznE5IbHKyOutcH4E7TwZum1Hle3.exe\" O" e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat -
Executes dropped EXE 2 IoCs
pid Process 5108 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat 4624 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat -
Sets file execution options in registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " " e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " " e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " " e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " " e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\2229298842\4066884077.pri LogonUI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\2qNmdtzh4i0j8aZIWjCRrrrcKqyJ.exe\" O 2>NUL" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\x61Ib8vq5.exe\" O 2>NUL" e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\S-1-5-20 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\yMkj7j30ooernHpivDiWPFkrs2KRFsJkisyqSi3k2hBFBLkLe8D0cLJRdXxaQC.exe\" O 2>NUL" e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\338388\\7HO3fCZKGJrE.exe\" O 2>NUL" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Floc\\FsoIAPVfgsxRe4W4Lj5mFSc4O3u3sHoioEd5DXo7MQa58rx.exe\" O 2>NUL" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\0fx48ci0.default-release\\startupCache\\aFBVWM7wRUeAgMM1MTcynN7YJY8DGJXG2pvVoGA3NNEu5W5jUof6E7IqZb.exe\" O 2>NUL" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\.DEFAULT 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer gpscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\64u8CXumD7fFzoeMgkXGjEskLmmOXhiPsh1CphlGcUt7hrhzuVtdGKIs4Zt0M0xDkb.exe\" O 2>NUL" e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gpscript.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\ar-IQ\\zWxEFbtMxK.exe\" O" e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\\LocalCache\\bSnN4RabSyZYc.exe\" O 2>NUL" e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\mk-MK\\41W13LWxWruLDSu1A4cDvHaW0ws55KsCNc82zzREKpdIq40Lajn5wC7tH36FLYnmQ.exe\" O" e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4234D49B-0245-4DF3-B780-3893943456E1} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009e9c5796f200d901 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FF393560-C2A7-11CF-BFF4-444553540000} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 010000000000000076cbaaa9f200d901 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\GrShaderCache\\xZlxFUGZcbCJeOczFhGIhVO2KLuWRN6YbnSgRbErV7g8FbN1h.exe\" O 2>NUL" e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\EsMxtPhvlK8wxA7OEG7vYi1yLKvvJAO8L6MOcbqN0RvIQe.exe\" O" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\OD0Uz55gH4eHgMBjPeDOrkQg3A5gWV1rGbPgAa9dEp.exe\" O" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-19 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\fa\\BCD1lWlCyacOCqqqCO5kvHwDd6Oq0FttHOh96PYhiL57m66TUubZjoUog5EI910YRtyg.exe\" O" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\B0ESNM48\\21rbZbnyGxvWmwNMNTgP0oYFbOQ5KGSdJ4gPRscWYRpRx3gDn.exe\" O" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "174" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000000d55b4a9f200d901 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\Links\\u9vyZbmfoRTLWXYttOo9.exe\" O" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\AC\\Microsoft\\CryptnetUrlCache\\Content\\mBXhCGw0JdmE9wDAnY77Fie4mnLWr8a4HzorGU3.exe\" O 2>NUL" 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Command Processor 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4624 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat 4624 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeBackupPrivilege 2232 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Token: SeRestorePrivilege 2232 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Token: SeShutdownPrivilege 2232 43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe Token: SeDebugPrivilege 5108 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Token: SeRestorePrivilege 5108 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Token: SeDebugPrivilege 4624 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat Token: SeRestorePrivilege 4624 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4704 LogonUI.exe 4704 LogonUI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 5108 2372 gpscript.exe 85 PID 2372 wrote to memory of 5108 2372 gpscript.exe 85 PID 5108 wrote to memory of 4624 5108 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat 88 PID 5108 wrote to memory of 4624 5108 e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat 88
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AC\e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AC\e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat" 22⤵
- Executes dropped EXE
- Sets file execution options in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Users\Admin\AppData\Local\Temp\43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe"C:\Users\Admin\AppData\Local\Temp\43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f.exe"1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39cc855 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4704
-
C:\Windows\system32\gpscript.exegpscript.exe /Shutdown1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AC\e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AC\e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat" 12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
- Executes dropped EXE
- Sets file execution options in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy\2YhVPWYr1HhzEIKM1q6mdDLj8BT.bat
Filesize2.4MB
MD5df6062920cc74522baf760381435d80f
SHA1b6165c1544b0e779ab7defdbf1d46604b40a6b8e
SHA256631d1013aa9e036f686cb57fe79383a803ef5d9320c3a847361f258ddb667d39
SHA5123934703fd6c61bab30fb448ea5a662fca51f0060881419bf52339f3e44d33133060464e255d0efc95f752b79713d71eb2410ecc48ecb6ee7a333be87550ce5b2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Floc\FsoIAPVfgsxRe4W4Lj5mFSc4O3u3sHoioEd5DXo7MQa58rx.exe
Filesize1.3MB
MD5a9ea8afd1ebc262ec650432c6da3fb0c
SHA1c041b84ed9ee5ffcaae03d0b08db9332e7df9993
SHA256287bc0fc2103ede4019ae50b6800e84893f8d12058dd3900fefd6098f0a7d01f
SHA512b53821f4f76efb021da51489a890c79007127583eace351bdd6564a50004104fdfdaea51dcc24221a6661b56e2e782a35df32573abc2abde5137a1b23788c8f1
-
Filesize
1.5MB
MD5d51a94b553005fa222d664ba2d6e973a
SHA19b4bdc0a2b9fc2d6bf4bd7286ec26d84ba0d4172
SHA256ef5aa7a28bd3f288cfafaf4a68f837fc8151943c24f2aa26a58bb2c4fae3370b
SHA51293667be86edafac683fa1220bb1b7caf64d5d8a4e75b2d5c259457d89481252460191354ef791b96dbd30299603ea17027c9791df55dd18a0cc537b387ed2aba
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fa\BCD1lWlCyacOCqqqCO5kvHwDd6Oq0FttHOh96PYhiL57m66TUubZjoUog5EI910YRtyg.exe
Filesize1.5MB
MD51d767faec694e64087a6c9ded11b4d2a
SHA1191a0379307f440ffdd0e7a8d59c0f5894a1f877
SHA25674e047adf98486bd36d80e4481808d866fbc611281eb34291565b7772633b5e9
SHA512074f72c77022fc8f85b3623c87463e3273b7d54f81c9be490ac35ce7047d8da7bcbf2531b08ca82ebca19a2279cd83f87c6e002ee022a6823bc7087d353cfa3d
-
Filesize
1016KB
MD580cd73c5080765896de12dfff8998472
SHA1ea380f03271d2dd9d8f3cc1a81cab010f677ca4b
SHA256b5fff2e1fa608b48857765d58de000c58d27d64a1f126ed9016041d9a5625809
SHA5125b46d516e2fcc28d7499ca5743831d9d5462cd62cd50e92a279b8d9242337591139bef2c6badd471666a4f2a670b60339ed6c8210c5c87f81ae8af779c82e253
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AC\e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat
Filesize1.3MB
MD59bb71e55e14d3337ea79f460d48b4bf6
SHA1e50d37e3c1e6209970c8a8e2eb17ec5a028d2182
SHA2565c363dcd9674017767a78e19ff0bdfdc257636c3aed4892498a7d07dd4293954
SHA5128543d9a2caeea83cb1bb214787d9b8f60799a750ffddc2bcd729182682589dcc057d6d51e131b75dbe73c34abd49fdcf32a522e11ca7097bb02bca51564f1aca
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AC\e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat
Filesize1.3MB
MD59bb71e55e14d3337ea79f460d48b4bf6
SHA1e50d37e3c1e6209970c8a8e2eb17ec5a028d2182
SHA2565c363dcd9674017767a78e19ff0bdfdc257636c3aed4892498a7d07dd4293954
SHA5128543d9a2caeea83cb1bb214787d9b8f60799a750ffddc2bcd729182682589dcc057d6d51e131b75dbe73c34abd49fdcf32a522e11ca7097bb02bca51564f1aca
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AC\e8et0FK4OUCAwhkzPw44K9JepFfSA0fSoyaGhue.bat
Filesize1.3MB
MD59bb71e55e14d3337ea79f460d48b4bf6
SHA1e50d37e3c1e6209970c8a8e2eb17ec5a028d2182
SHA2565c363dcd9674017767a78e19ff0bdfdc257636c3aed4892498a7d07dd4293954
SHA5128543d9a2caeea83cb1bb214787d9b8f60799a750ffddc2bcd729182682589dcc057d6d51e131b75dbe73c34abd49fdcf32a522e11ca7097bb02bca51564f1aca
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\EsMxtPhvlK8wxA7OEG7vYi1yLKvvJAO8L6MOcbqN0RvIQe.exe
Filesize1.5MB
MD5d5e8c6d9cdfdbda174a1c0f6f22ef5ee
SHA1a295651df0495c4af16b012ca462d808e2390180
SHA2566d15005fda1d5bbc58772999987b261a03682640f10032543410e7347e58526b
SHA51291a450a1180cb7eb6e0162b7dcdab72c278b6208c6e1d1d417c3dea69469a92fd0214bac2612cbb5753e255c99ada75d21a883f7a2458486be644f1769bd0606
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\7HO3fCZKGJrE.exe
Filesize1.1MB
MD554f04fba73e226287b0b129083213bc4
SHA17cb0034bafba2cec93dc893a4d5cc267820545b9
SHA256b52fc8e7c18f01d581c2f48f1fa85c3ed71e43af8e1427380757ad5fe47cb92a
SHA512cd485c36e3ecf3bb5701ac241d0f8a8972a42968982b194ae7ca5ff8307ceaf51159542e637fbb52c58173466e27333fa76bb31d374d797eb7da2c6df2229601
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\B0ESNM48\21rbZbnyGxvWmwNMNTgP0oYFbOQ5KGSdJ4gPRscWYRpRx3gDn.exe
Filesize1.3MB
MD5f60f6a8361bd3353159d33dbffa87427
SHA119683d8667ae46b15fb162aa6e75b4d11f029b83
SHA2566c417600086223c47353dfcd00f3b8803ce02706dc359346288c0bd964b29be1
SHA51232a3d08d958c1e33152caef3bf5711cb19ed5d1d2eeb6e1ae6471cb90043546dd967f1c4671faf2d4bfb3fe639e51a5655e6bceead8cb91243003999029749fc
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\e6TB0gPCjLRmDT9DNUK7iV7Oajkkj.exe
Filesize1.3MB
MD5080b5c80e52caee8025c87be53711489
SHA14694f9caefe59c79a784fdb6cddb9de6ac167e37
SHA2562353657ad0a5295720b569fcfc40291ac80a1551dd4f52a21a8e2af6b62f5f0e
SHA51230c34776feea31797639dbd328d09522c818c56920c545740c55799f1600bf049b86178322acdd80263c214d373217587b7257a2374a93e10d5b5065d70eb2c5
-
Filesize
791KB
MD54f03f7a98beb4eb42e4b6f7ab8aaa793
SHA18c27843b26680826620fafedcd0b213e99e5ba94
SHA2564c1bf6cc985fa3924139a4c87956f6754cba44514c21a44a94fd52b77aea1804
SHA512899aeb81b4af9ee3dbda22fdae360951c7436b807d769c303bd35a16d94f645c32bbcff169178e8f3490283bc2399e0889d94f83a9c4a9389a602479dffce9c8