Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe
-
Size
94KB
-
MD5
395df6e70432829bec3852306ff63ecd
-
SHA1
0a3735863450d4fb8ed6173185e68022b2c17cda
-
SHA256
fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a
-
SHA512
5f8d4b01a5e3488d27bef72e3345d727fca1ca066650b41f8041bfd0f18becebc4ffcace27ce462b8e20312f3f85020f39a6c4c5026a78c8712ff41771633f0d
-
SSDEEP
1536:KuieF4ac5TP1zzi5Rhezd6mVx+Ysb+oou:K+NG1Pzd6mv+Yp
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{T1H79034-793P-Z8I7-U2JK-0135803QAYK7} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{W1EQ9HL6-0AH5-6255-7Y4M-U12L8H5K9B4U} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{722K8014-ZH44-SC4L-833L-Y1240954TD4M} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{6PBH568E-57ZA-MUS2-L881-KNB035V23691} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{T1H79034-793P-Z8I7-U2JK-0135803QAYK7} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{2FRXE2KU-DJ5Q-C4TX-04NT-016092L8ZG57} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{H38Y467Y-1469-GQ5Z-3L8Z-B6701460HR5A} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4KUZ2RT0-JN71-DK6E-3662-M50X23Z936Y0} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ONAA1QVY-E70G-E48E-1OBB-26WZF7RHG48F} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{78AJTY1F-SAY4-R003-6SG2-57A45W13NX91} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{0HKQUC2Q-92P6-A1NR-1I4R-VD369327B1OS} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{93IN71HO-X0G6-031S-V15T-Z0587I4MXEL5} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{MSXEKT03-H7C2-Q78K-NUYF-LU0437E2R880} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S70KO7DE-K6F3-RR2M-OAXG-KZ946YB1591I} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{83IP8J48-V4R7-1CK5-D158-CFI6BH55036V} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8U23891Q-WAI5-W1D4-8833-MZ125CJ55UE4} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{4W1K4P9J-O783-6YC2-RSY2-382FK60EMU9D} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{R90ENXC3-JW1C-Q82G-N784-J79E6SA34R01} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{J557HNRZ-1N7U-1550-0OQ8-3OTA258V1550} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{P8948VA2-7UCK-OT15-87FI-60HN5032V99L} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{YH24RD25-8A1P-AHD6-7DN7-9ZMUS2L4813M} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{P7X3368Z-N880-H78C-45UE-PWT2JSCH5PB3} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{6PBH568E-57ZA-MUS2-L881-KNB035V23691} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{G3T83ORX-BJOX-1549-H3U9-9PSYCK692659} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5YXC3UW1-NRG2-69FH-4713-P61L39CM57BD} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{MSXEKT03-H7C2-Q78K-NUYF-LU0437E2R880} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{T1H79034-793P-Z8I7-U2JK-0135803QAYK7} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{N82LR725-4Z1E-PWD2-7SCH-5ZB3RV04LS9M} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{4S12580F-Q68E-6VED-I5A0-4TWMM8D4N6A3} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{ZBJRVA44-S9M6-991J-8XF5-622S9G3M8FK6} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{037A0L5Y-C578-C2O7-13TC-1M59D679D368} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{5AC4TX04-NT0O-60Z6-V83G-P7I370HKN8GL} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{R1J2T8G6-8BCO-WU3N-592M-PD046X347023} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{P7X3368Z-N880-H78C-45UE-PWT2JSCH5PB3} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{78AJTY1F-SAY4-R003-6SG2-57A45W13NX91} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{GFRS83MP-WLSY-815V-8G7T-X3O6XMJZ91OX} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{83IP8J48-V4R7-1CK5-D158-CFI6BH55036V} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4S12580F-Q68E-6VED-I5A0-4TWMM8D4N6A3} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{G4573Q87-BL7U-166V-H458-429VCN8W2I78} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{4KUZ2RT0-JN71-DK6E-3662-M50X23Z936Y0} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{GFRS83MP-WLSY-815V-8G7T-X3O6XMJZ91OX} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{P8948VA2-7UCK-OT15-87FI-60HN5032V99L} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{56W225VX-L879-F670-357C-OUR1HRAG4NZH} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{N5CEI812-571J-36D0-PP7F-KN7368T04T7D} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{561CMR93-LTBF-K88C-3WZ3-3YE26P9066CI} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{J557HNRZ-1N7U-1550-0OQ8-3OTA258V1550} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{X92QU3JU-B345-X24S-TGOM-0F668EHU713O} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{G4573Q87-BL7U-166V-H458-429VCN8W2I78} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{2FRXE2KU-DJ5Q-C4TX-04NT-016092L8ZG57} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y1JQWF48-U2P6-C22M-AGKS-XG5NV2F77235} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5XC3381-0Q8G-GN78-4JTY-1QSAJMR01J6D} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5XC3381-0Q8G-GN78-4JTY-1QSAJMR01J6D} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4W1K4P9J-O783-6YC2-RSY2-382FK60EMU9D} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{HOUD3J61-C561-24YE-IQ8E-4L71166UG458} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S8INQ8B3-OX15-LXH3-U99O-RYCKPY26N9I4} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{S8INQ8B3-OX15-LXH3-U99O-RYCKPY26N9I4} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{48U2P6C2-34AG-LSYH-5N82-277235BIMT93} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{687GJ7CI-5503-2W0A-MSZ0-6OYE3VX2OS82} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{P8948VA2-7UCK-OT15-87FI-60HN5032V99L} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GFRS83MP-WLSY-815V-8G7T-X3O6XMJZ91OX} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BG4NAHQ7-Z336-9AO9-80I7-8D46VFQXU2KT} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4F3C-8081-5663EE0C6C49} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A919514-BA8B-43b3-B11A-7EFBB978E17B} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A919514-BA8B-43b3-B11A-7EFBB978E17B} fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1928 wrote to memory of 112 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 28 PID 1928 wrote to memory of 112 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 28 PID 1928 wrote to memory of 112 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 28 PID 1928 wrote to memory of 112 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 28 PID 1928 wrote to memory of 112 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 28 PID 1928 wrote to memory of 112 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 28 PID 1928 wrote to memory of 112 1928 fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe"C:\Users\Admin\AppData\Local\Temp\fdf632aaefc99b36c89a9e1c8a7a07795b6f8a1aad7860eeca90d7273564d62a.exe"1⤵
- Modifies Installed Components in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s ToolBand2.dll2⤵PID:112
-