Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
214s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe
Resource
win7-20221111-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe
-
Size
90KB
-
MD5
4a88ae4b043e5e626c39a51d7e380b5a
-
SHA1
a833330f04fa886dc9e401766e7a1673f2a740f6
-
SHA256
ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42
-
SHA512
83b12a847cd4f639b13db4f7f6ce13965a4757415e698c9ea470680adf5de672479cc9c8927b8a18be012002adc18083b0894226c803626e23025dcc844ac9f9
-
SSDEEP
1536:VmZWGE/gxwXe4U7bPPa/q4udgeApY06+5wHNxd9m1pLyg+eu+ixh8NJVnKu9ypLI:UZW8wPU/PPWCvmYXhhe2si/8pnfyf2qE
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 568 wmnet.exe 1568 QQjiji.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esslibupdate.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\extdb.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxup.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxup.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanFrm.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safeup.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpFile.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpFile.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\extdb.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ÐÞ¸´¹¤¾ß.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanFrm.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360deepscan.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ÐÞ¸´¹¤¾ß.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Down.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safeup.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsMain.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsMain.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Down.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe\Debugger = "TASKMAN.EXE" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe -
Deletes itself 1 IoCs
pid Process 1548 cmd.exe -
Loads dropped DLL 5 IoCs
pid Process 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 568 wmnet.exe 568 wmnet.exe 1568 QQjiji.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SOUNDMAN = "C:\\Progra~1\\Realtek\\ADPPath\\RTHDCPL.exe" ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Key created \REGISTRY\MACHINE\SoftWare\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Progra~1\Realtek\ADPPath\RTHDCPL.exe ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe File created C:\Program Files (x86)\Common Files\System\admin.obj QQjiji.exe File created \??\c:\program files\google\chrome\application\89.0.4389.114\installer\ws2help.dll QQjiji.exe File created \??\c:\program files (x86)\common files\microsoft shared\office14\office setup controller\ws2help.dll QQjiji.exe File opened for modification C:\Program Files (x86)\Common Files\System\QQjiji.exe wmnet.exe File created C:\Program Files (x86)\Common Files\System\QQjiji.exebnb wmnet.exe File opened for modification \??\c:\program files (x86)\common files\adobe air\versions\1.0\ws2help.dll QQjiji.exe File created \??\c:\program files (x86)\common files\adobe air\versions\1.0\ws2help.dll QQjiji.exe File opened for modification \??\c:\program files\google\chrome\application\89.0.4389.114\installer\ws2help.dll QQjiji.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\office14\office setup controller\ws2help.dll QQjiji.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e QQjiji.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e QQjiji.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\SystemCertificates\CA\Certificates\C81A8BD1F9CF6D84C525F378CA1D3F8C30770E34 QQjiji.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\SystemCertificates\CA\Certificates\C81A8BD1F9CF6D84C525F378CA1D3F8C30770E34\Blob = 030000000100000014000000c81a8bd1f9cf6d84c525f378ca1d3f8c30770e34140000000100000014000000c8d97868a2d91968d53d72de5f0a3edcb58686a604000000010000001000000058aa23107c8d5aedeabd0d5e325785920f0000000100000030000000c3b50ae46b6997dd20d643339b1141cd1e85d7a966edda72de71b1b27513a7e0efb1103a0538a8da7bdbd43889b33ebd19000000010000001000000099456d27b589e0bd3dcacb8996e62c09180000000100000010000000ea6089055218053dd01e37e1d806eedf4b0000000100000044000000300037004300450046003200460036003500340045003300450044003600300035003000460046004300390042003600450042003800340034003200350030005f0000002000000001000000d9060000308206d5308204bda00302010202106c55abdbd00792c79d070cd8119ed6bf300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3230303133303030303030305a170d3330303132393233353935395a304b310b30090603550406130241543110300e060355040a13075a65726f53534c312a3028060355040313215a65726f53534c2052534120446f6d61696e20536563757265205369746520434130820222300d06092a864886f70d01010105000382020f003082020a02820201008669737ea3b531d823e16ddda413d35415f502ebdc0321b57e5d1d527c3f31eb9e096cd159385e677e4b568f7590b2370c355a64a5be4c102c2418c46d898cc1c5924d6602839df7e12174f9cb4302c171b17fab4c387d912ac6ff89a9e8e4a1b9b2da108509899a38b7cef74ee49dd168f90d6b770eda401bc4f7e65feffb1acdf2e6fc3d24a85f9564830fa359fe0a42d36f5052c3abc9855a15273cbea31c00035e9bece254cd6303adc7dc90b5ba71c12b7b409635f880ab991241e81b8a46dfe37c3245f49b1c4505651c8c5074a00997ba1a5675e00e4aad936a9d75dde40835ddef882ff35dc6f75cfb0a3b06c89f77a09225352dd48056c3e95e7824c819deb4a6a2d61bcfdf286715fb30a6ed0a6d5a27fabe853bf660ad72331ae77dc89e2a639805b1438675b93ba44c03bd377412bdda3e9744dd84b6d2e442eba3660cbe8d744ab5a58c22590d9162663a21e612b427807bed88d90872326e9aad5d7455f889a4c8e346bace0bc806dc45783b3645f71a1fbddeafb72d35452a8104f9ac580984c985c7beab420079399524a1d6f99367b1ecff86bb827ce9b4b5e74f7852e61c574f6155e927993879131f4204a8a92d2d96db02816a47fe69562734253a4b49c04aab76c6b669182d6feefe8386e7a9cb226d9f7a925763e80625394aa97e680469c1489b40c1a6e38823c8d0ea0e5569f9284b425507f71f0203010001a382017530820171301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414c8d97868a2d91968d53d72de5f0a3edcb58686a6300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102024e3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c05000382020100150f0a08cd00d57ab713d1e62a66304d27c54d5b05459503ad64446a9f98969c455a2d965dcf195bbf3d85c7413150db9412062421533862870a90243b84ee67a22728abf0eb1181f922e35cb96d48f09259f432ee0757d8bc81e5676246e3a88d6d5280df2800133f3a46f0d096dd82e3de2aa8f548b518ebcfd625244193d03aedb72029ab460b143cdff99d6990c861edcfbb7d7789aa62217c9a5db8a73c1c442461041285e9f8dba4b71f426b2006ca7010a2c9816e3a17f2beec150850df16fae30038dde235f5b905ddd7ad48c8545b9bcf6cd8e8f9a14d700d8cf9b31fa1a02ba1ea54acfbfb8fb96a2622adf2d460c535a7d6f8bb07054d7a950a39436ca1db995a42c2918323e63291c9f7c79d9bacb6b0751a6c04a6447c6f1a2bb0c04db9683534d9201e7a9c88989d82cc1f34606ed6c65ca71ea361a44ef17c2ecfcd094b8267c41dd53eb4715e41acd1427ac5916d9692a44622aedc2919f2ca9be33cc9237a257d95174033d7d226fb01decbd4baed5ca081b5c71235c9e82818ce2be503f8446215bd86a223be82d1d8e849b43f76421451742e07c00be63c87df883705969a5f2be99a75788a5a693175409c060638de755a127a5b4c4d74d270cd80126581feb6609623e37ad06bf634d3061f0319edef5b5e0cd40991f915a0450c64794bd556a8707bdd0f8ec8856f21b298712736c3f692b8528648 QQjiji.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C QQjiji.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 QQjiji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 QQjiji.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1952 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Token: SeDebugPrivilege 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Token: SeDebugPrivilege 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Token: SeDebugPrivilege 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Token: SeDebugPrivilege 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Token: SeDebugPrivilege 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe Token: SeDebugPrivilege 568 wmnet.exe Token: SeDebugPrivilege 1568 QQjiji.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 568 wmnet.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1408 wrote to memory of 1116 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 28 PID 1408 wrote to memory of 1116 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 28 PID 1408 wrote to memory of 1116 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 28 PID 1408 wrote to memory of 1116 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 28 PID 1408 wrote to memory of 892 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 29 PID 1408 wrote to memory of 892 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 29 PID 1408 wrote to memory of 892 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 29 PID 1408 wrote to memory of 892 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 29 PID 1408 wrote to memory of 580 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 31 PID 1408 wrote to memory of 580 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 31 PID 1408 wrote to memory of 580 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 31 PID 1408 wrote to memory of 580 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 31 PID 892 wrote to memory of 1360 892 net.exe 36 PID 892 wrote to memory of 1360 892 net.exe 36 PID 892 wrote to memory of 1360 892 net.exe 36 PID 892 wrote to memory of 1360 892 net.exe 36 PID 1116 wrote to memory of 564 1116 net.exe 34 PID 1116 wrote to memory of 564 1116 net.exe 34 PID 1116 wrote to memory of 564 1116 net.exe 34 PID 1116 wrote to memory of 564 1116 net.exe 34 PID 580 wrote to memory of 1820 580 net.exe 35 PID 580 wrote to memory of 1820 580 net.exe 35 PID 580 wrote to memory of 1820 580 net.exe 35 PID 580 wrote to memory of 1820 580 net.exe 35 PID 1408 wrote to memory of 568 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 37 PID 1408 wrote to memory of 568 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 37 PID 1408 wrote to memory of 568 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 37 PID 1408 wrote to memory of 568 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 37 PID 1408 wrote to memory of 1548 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 38 PID 1408 wrote to memory of 1548 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 38 PID 1408 wrote to memory of 1548 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 38 PID 1408 wrote to memory of 1548 1408 ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe 38 PID 568 wrote to memory of 1568 568 wmnet.exe 40 PID 568 wrote to memory of 1568 568 wmnet.exe 40 PID 568 wrote to memory of 1568 568 wmnet.exe 40 PID 568 wrote to memory of 1568 568 wmnet.exe 40 PID 568 wrote to memory of 1776 568 wmnet.exe 41 PID 568 wrote to memory of 1776 568 wmnet.exe 41 PID 568 wrote to memory of 1776 568 wmnet.exe 41 PID 568 wrote to memory of 1776 568 wmnet.exe 41 PID 1776 wrote to memory of 1124 1776 cmd.exe 43 PID 1776 wrote to memory of 1124 1776 cmd.exe 43 PID 1776 wrote to memory of 1124 1776 cmd.exe 43 PID 1776 wrote to memory of 1124 1776 cmd.exe 43 PID 568 wrote to memory of 1924 568 wmnet.exe 44 PID 568 wrote to memory of 1924 568 wmnet.exe 44 PID 568 wrote to memory of 1924 568 wmnet.exe 44 PID 568 wrote to memory of 1924 568 wmnet.exe 44 PID 1924 wrote to memory of 1952 1924 cmd.exe 46 PID 1924 wrote to memory of 1952 1924 cmd.exe 46 PID 1924 wrote to memory of 1952 1924 cmd.exe 46 PID 1924 wrote to memory of 1952 1924 cmd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe"C:\Users\Admin\AppData\Local\Temp\ef0b0aedc0cf0e39e5c1ac3c905127649bbce354e445825af80fdc207c5c1b42.exe"1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\net.exenet stop "Security Center"2⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"3⤵PID:564
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Windows Firewall/Internet Connection Sharing (ICS)"2⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"3⤵PID:1360
-
-
-
C:\Windows\SysWOW64\net.exenet stop System Restore Service2⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop System Restore Service3⤵PID:1820
-
-
-
C:\Users\Admin\AppData\Local\Temp\wmnet.exeC:\Users\Admin\AppData\Local\Temp\wmnet.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Program Files (x86)\Common Files\System\QQjiji.exe"C:\Program Files (x86)\Common Files\System\QQjiji.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Windows\SysWOW64\cmd.execmd /c erase /A:RHSA "C:\Users\Admin\AppData\Local\Temp\wmnet.exe"&cmd /c del "C:\Users\Admin\AppData\Local\Temp\wmnet.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\wmnet.exe"4⤵PID:1124
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping -n 2 127.0.0.1>nul&del /F /Q /A : RSAH "C:\Users\Admin\AppData\Local\Temp\wmnet.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:1952
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del C:\wmiprvse.exe2⤵
- Deletes itself
PID:1548
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD53d9abc0931ba2fe5e0ece6f31336e4c5
SHA15ed3751d91a899ac1a1606941c7001135d7adde5
SHA2565f1b9bacb3801decc2287473efac54cb85e438cf50024c55189b30974a29c89e
SHA512885857b18e7f51014887254553dea8a5760a87f2551ef8ae204b9e2ec0a14a4fafc875f286d23428e8492b4a398df12def927eaa1aff9e7440ccdf8df6b38c35
-
Filesize
34KB
MD53d9abc0931ba2fe5e0ece6f31336e4c5
SHA15ed3751d91a899ac1a1606941c7001135d7adde5
SHA2565f1b9bacb3801decc2287473efac54cb85e438cf50024c55189b30974a29c89e
SHA512885857b18e7f51014887254553dea8a5760a87f2551ef8ae204b9e2ec0a14a4fafc875f286d23428e8492b4a398df12def927eaa1aff9e7440ccdf8df6b38c35
-
Filesize
34KB
MD53d9abc0931ba2fe5e0ece6f31336e4c5
SHA15ed3751d91a899ac1a1606941c7001135d7adde5
SHA2565f1b9bacb3801decc2287473efac54cb85e438cf50024c55189b30974a29c89e
SHA512885857b18e7f51014887254553dea8a5760a87f2551ef8ae204b9e2ec0a14a4fafc875f286d23428e8492b4a398df12def927eaa1aff9e7440ccdf8df6b38c35
-
Filesize
34KB
MD53d9abc0931ba2fe5e0ece6f31336e4c5
SHA15ed3751d91a899ac1a1606941c7001135d7adde5
SHA2565f1b9bacb3801decc2287473efac54cb85e438cf50024c55189b30974a29c89e
SHA512885857b18e7f51014887254553dea8a5760a87f2551ef8ae204b9e2ec0a14a4fafc875f286d23428e8492b4a398df12def927eaa1aff9e7440ccdf8df6b38c35
-
Filesize
34KB
MD53d9abc0931ba2fe5e0ece6f31336e4c5
SHA15ed3751d91a899ac1a1606941c7001135d7adde5
SHA2565f1b9bacb3801decc2287473efac54cb85e438cf50024c55189b30974a29c89e
SHA512885857b18e7f51014887254553dea8a5760a87f2551ef8ae204b9e2ec0a14a4fafc875f286d23428e8492b4a398df12def927eaa1aff9e7440ccdf8df6b38c35
-
Filesize
34KB
MD53d9abc0931ba2fe5e0ece6f31336e4c5
SHA15ed3751d91a899ac1a1606941c7001135d7adde5
SHA2565f1b9bacb3801decc2287473efac54cb85e438cf50024c55189b30974a29c89e
SHA512885857b18e7f51014887254553dea8a5760a87f2551ef8ae204b9e2ec0a14a4fafc875f286d23428e8492b4a398df12def927eaa1aff9e7440ccdf8df6b38c35
-
Filesize
50KB
MD5dee2a616c3e4ee1fb83cbc8549fe30a8
SHA1fb3d3e33a44028e4afdda43956037bc03b82d34a
SHA2561ede5bc76517666c329991c9c98528644447bffcef8f3c5c44284ef7b8c461df
SHA5120fa4bbb3fb52045e43703692934d1f1753badc96d9d1e7b6677d3fa562415e61a498c3af85109bdc21b12a9942bf90a9a04f0dd191a7f75a7e5cadfbb3158208
-
Filesize
34KB
MD53d9abc0931ba2fe5e0ece6f31336e4c5
SHA15ed3751d91a899ac1a1606941c7001135d7adde5
SHA2565f1b9bacb3801decc2287473efac54cb85e438cf50024c55189b30974a29c89e
SHA512885857b18e7f51014887254553dea8a5760a87f2551ef8ae204b9e2ec0a14a4fafc875f286d23428e8492b4a398df12def927eaa1aff9e7440ccdf8df6b38c35
-
Filesize
34KB
MD53d9abc0931ba2fe5e0ece6f31336e4c5
SHA15ed3751d91a899ac1a1606941c7001135d7adde5
SHA2565f1b9bacb3801decc2287473efac54cb85e438cf50024c55189b30974a29c89e
SHA512885857b18e7f51014887254553dea8a5760a87f2551ef8ae204b9e2ec0a14a4fafc875f286d23428e8492b4a398df12def927eaa1aff9e7440ccdf8df6b38c35