Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 20:38
Static task
static1
Behavioral task
behavioral1
Sample
967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe
Resource
win7-20220901-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe
-
Size
806KB
-
MD5
9181a704b26bb53b42f1128c705c3a18
-
SHA1
f7cd0ce1a7eab4822aab7675cc96670c545b5a21
-
SHA256
967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048
-
SHA512
63757f17c9830f500982273edcba240728ace78b5223ec417103c81e2c4c232a2384f7fd4da79c596b7179ddc77d303c305af45cd1dff603d2e422adb805fb0a
-
SSDEEP
12288:4EncCP0UpnIIxU8H3Ek9aL4cLdWoRA4SWxxL2Ls/unEIZUlxOnY7a+z:NcaAIxL3EkyrLd7L9dIKxQXS
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\WINDOWS\system32\drivers\etc\hosts 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe File created C:\WINDOWS\system32\drivers\etc\hosts 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\msscp.reg 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe File opened for modification C:\Windows\SysWOW64\msscp.reg 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\taobao.ico 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe File created C:\Program Files\Common Files\System\taobao.ico 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\web\Index.htm 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe File opened for modification C:\Windows\web\Index.html 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe File created C:\Windows\web\Inde.html 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe File created C:\Windows\web\Index.htm 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe File created C:\Windows\web\Index.html 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TYPEDURLS 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.a585.com" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.a585.com" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe -
Modifies registry class 53 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O) 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M)\Command 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O) 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\Command\ = "iexplore.exe C:\\WINDOWS\\Web\\index.html" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\System\\taobao.ico" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R)\Command 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\1 = "20221207" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ɾ³ý(&D) 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\ = "´ò¿ªÌÔ±¦Íø(&T)" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43} 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M)\Command 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\5 = "152051" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ = "Internet Explorer" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\HideFolderVerbs 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\HideOnDesktopPerUser 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\9 = "1" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R) 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\Attributes = "0" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\HideOnDesktopPerUser 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ = "ÌÔ±¦Íø£¡" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\Command 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\WantsParseDisplayName 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pz 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\Attributes = "0" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\Command 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42} 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M) 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\WantsParseDisplayName 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\DefaultIcon 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\Command\ = "iexplore.exe C:\\WINDOWS\\Web\\index.htm" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ɾ³ý(&D)\Command 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M) 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R)\Command 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R) 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\9 = "0" 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ɾ³ý(&D)\Command 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ɾ³ý(&D) 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\HideFolderVerbs 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\DefaultIcon 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe -
Runs .reg file with regedit 2 IoCs
pid Process 1688 regedit.exe 1360 regedit.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1688 1484 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 27 PID 1484 wrote to memory of 1688 1484 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 27 PID 1484 wrote to memory of 1688 1484 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 27 PID 1484 wrote to memory of 1688 1484 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 27 PID 1484 wrote to memory of 276 1484 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 28 PID 1484 wrote to memory of 276 1484 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 28 PID 1484 wrote to memory of 276 1484 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 28 PID 1484 wrote to memory of 276 1484 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 28 PID 276 wrote to memory of 1360 276 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 29 PID 276 wrote to memory of 1360 276 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 29 PID 276 wrote to memory of 1360 276 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 29 PID 276 wrote to memory of 1360 276 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 29 PID 276 wrote to memory of 1936 276 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 30 PID 276 wrote to memory of 1936 276 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 30 PID 276 wrote to memory of 1936 276 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 30 PID 276 wrote to memory of 1936 276 967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe 30 PID 1936 wrote to memory of 868 1936 IEXPLORE.EXE 31 PID 1936 wrote to memory of 868 1936 IEXPLORE.EXE 31 PID 1936 wrote to memory of 868 1936 IEXPLORE.EXE 31 PID 1936 wrote to memory of 868 1936 IEXPLORE.EXE 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe"C:\Users\Admin\AppData\Local\Temp\967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg2⤵
- Runs .reg file with regedit
PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exeC:\Users\Admin\AppData\Local\Temp\967ffa08260e0fc2b0d2299ff4b03abc2baa45cf7e788117f42be369cd49c048.exe2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg3⤵
- Runs .reg file with regedit
PID:1360
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" C:\Windows\web\Inde.html3⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" C:\Windows\web\Inde.html4⤵
- Modifies Internet Explorer settings
PID:868
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5468fada123f5548ac87e57bae81f6782
SHA1edb8f012c25906e6afd8bf335b495e16c440243d
SHA256091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d
SHA512635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa
-
Filesize
3KB
MD5a0bfe41ae7dc42b53a9b681a3f128166
SHA17072a312b976921034857579d2665b0d61c9f87d
SHA256ad89b82292371265f2abb02819af698033ecaf6ef0a55a5c48a7c5637cb89287
SHA512cbd9a3de72b41f8a55ddb918f8d5047be3582e056555d8e6350fcc569781ae1f8d35c2bbe0eb50e1bc40d7da130ff01c9437c2217ebcd07b2b97d38b2f35cb64
-
Filesize
228B
MD52d06a424ad1c7611ea9caad93892ea26
SHA1a901e15c2ecea498f1ca8ffc5d5c32bd3f0169d8
SHA2568c19027357bcb3170b6844aec44cd4c143c7b795d5df52ff89426615010f715c
SHA5123199dffce9d7625d9e01d7a06c912d3629e5f3d98d3935763df6b323807d46f24a40876d78d5ae7f7ac83c90e498e7c4810d88993904dbca1036e8c06833ccdf
-
Filesize
228B
MD52d06a424ad1c7611ea9caad93892ea26
SHA1a901e15c2ecea498f1ca8ffc5d5c32bd3f0169d8
SHA2568c19027357bcb3170b6844aec44cd4c143c7b795d5df52ff89426615010f715c
SHA5123199dffce9d7625d9e01d7a06c912d3629e5f3d98d3935763df6b323807d46f24a40876d78d5ae7f7ac83c90e498e7c4810d88993904dbca1036e8c06833ccdf