Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26/11/2022, 21:49
Static task
static1
Behavioral task
behavioral1
Sample
9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe
Resource
win7-20220812-en
General
-
Target
9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe
-
Size
2.6MB
-
MD5
4bfaf4334b36db4e10e1c7e63a6889af
-
SHA1
77b2ee9f7e39d548f42da877bda97bff83e9315e
-
SHA256
9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c
-
SHA512
4546dc9ba1180038c2f2015c0db1cbed07ac3a042010c2f232104b2e60c7f36614208fa648f7183da99a4c301a0cd9a721eecabd0ca3588c57aa465de312d8d9
-
SSDEEP
49152:gfJ3tfIakU9sxt4jL148SgiQbEf1AnjxN3NIy0kbp0ik1LrhPm:gfJ9fRkU9sxtQOgPbaajxzIobp0iE
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe -
resource yara_rule behavioral1/memory/1608-57-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-59-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-60-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-61-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-62-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-64-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-66-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-70-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-68-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-72-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-74-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-76-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-78-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-82-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-80-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-84-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-88-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-86-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-90-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-92-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-94-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-96-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-100-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-98-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-102-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-104-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1608-108-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Wine 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\store.taobao.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\store.taobao.com\ = "143867" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "288182" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004bd47573063e314dbba71fbedaf345cd0000000002000000000010660000000100002000000070fc3f604fdacb78a25f2174da10db0a80ebbaea128547f90201daaf97832476000000000e8000000002000020000000e8b794380cbbeb594ba7a5bbb272ad61804d53bc82738702babf4a9735236068900000001913933da8a8372796a9360ad7e182fb2dfd4861b99273073bd6dbf2feb27190b7eeac2dcaa0825ff418bcc80e791f316991ae764a9cd94e9088875db1ac8a8dbf1764d9c3f7505d21f6e99872eee7a441a47bbe5e21409e8c32d2e11a31955fde6d82828b2e0e361af38b70d2d20cad69bd7b59c0c6ea7b60ac915af93f4102cae30d95236e027f17e354c35637b6b940000000c647a14f45d9bc2ff52c89d5b0993d41886d6940ec3463fe60c44b67773ddae3dfbece5a8a75d8cb86cf0afdc6d0c5295b06bf4dadcf3c0b6660484a04222440 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375726363" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\00000wg.com\NumberOfSubdomains = "1" 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "288089" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004bd47573063e314dbba71fbedaf345cd0000000002000000000010660000000100002000000046b712f968ac6487273cb9ff9f3cb7edafa6057778be0a505a804a9209cdf700000000000e80000000020000200000006d5c628361f943c13c44b587756eec75617ba623d6ae39cf4425526fd7f6554b20000000da9f54ac2bd2131e7256a634a0b43d6bc690cf675894ee178a297b538bb089cf4000000063038454dccbbf4b20cb51eac34ba67f44df29e52be831bcec011405689393a1f8697d0133bdc4ffccc889ed22b43e969e480e1377ba6306bee546bda5310137 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "144046" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "144209" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "144146" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.00000wg.com\ = "63" 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\00000wg.com\Total = "63" 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\store.taobao.com\ = "144146" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "144222" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\store.taobao.com\ = "60" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "143930" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "143923" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.00000wg.com 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\store.taobao.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "123" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "143930" 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\00000wg.com 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "144282" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "288026" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\guang.taobao.com\ = "143977" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "14" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\guang.taobao.com\ = "27" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "144173" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\taobao.com\Total = "288123" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305e909f7802d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\guang.taobao.com\ = "13" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\guang.taobao.com\ = "143880" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "288245" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\guang.taobao.com\ = "144036" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "77" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\store.taobao.com\ = "143923" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "143972" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: 33 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe Token: SeIncBasePriorityPrivilege 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 2036 iexplore.exe 2036 iexplore.exe 328 IEXPLORE.EXE 328 IEXPLORE.EXE 328 IEXPLORE.EXE 328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1608 wrote to memory of 2036 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 27 PID 1608 wrote to memory of 2036 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 27 PID 1608 wrote to memory of 2036 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 27 PID 1608 wrote to memory of 2036 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 27 PID 1608 wrote to memory of 1968 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 28 PID 1608 wrote to memory of 1968 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 28 PID 1608 wrote to memory of 1968 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 28 PID 1608 wrote to memory of 1968 1608 9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe 28 PID 2036 wrote to memory of 328 2036 iexplore.exe 30 PID 2036 wrote to memory of 328 2036 iexplore.exe 30 PID 2036 wrote to memory of 328 2036 iexplore.exe 30 PID 2036 wrote to memory of 328 2036 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe"C:\Users\Admin\AppData\Local\Temp\9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://schftx.taobao.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:328
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.weishiwg.com/2⤵PID:1968
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD53dcf580a93972319e82cafbc047d34d5
SHA18528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA25640810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
SHA51298384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD54173fbd5650225ad43b8e84f81ee1f9c
SHA1f7d9550eb248ce0a31f70485605ae64d4e300d22
SHA2560aee244fccffc477610f3026d1ddafa1b7bd718383b5503d95970468fe83e3f4
SHA512d1cf605b078bd18345c16ea2fa214cdf6400c4173a1520202bde01bd7e3f86bbd9256dac2dce71ffb889b45bc704eff8422b0efdea905c938d7b0bc4f1fd7292
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55826ef2531a796f8e842917dbbff5dd1
SHA1c561a92d6c3ed896a342b34bf0d7fe338a3130c9
SHA256f6ac362eb612596a0207457fa4f5d874212870265b777df0254f45c679083b52
SHA5124be751a680578598867bd5896f15ac42cf722cfc349abec4deea76adcbc2f96b41776b78dacb382819fa30c5fe2ad7299ea8f01fda1e79c7a7f402412f4ceb22
-
Filesize
20KB
MD5a1afe1a56792e72582414fd65c95b8b0
SHA1345a4296daf92764c321bf50434687d6ec3f72b2
SHA25616e298d7b16be43e38813e03833fd55e6eb27380b0a431d77af82f2d5771cdb0
SHA512ada169e8cf1b82e6374ed665249b6002be6ceb462941aeaa44325c95b58b32e8d1beb36a1534185192e459a94004200a67fd7fa663eef4f9ee318c62d95e97bc