Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 23:48 UTC
Static task
static1
Behavioral task
behavioral1
Sample
b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe
-
Size
104KB
-
MD5
2c46e758200bdae00d795f06f8f0234a
-
SHA1
c050af649f70f7284c0da7101abbf77e62032a94
-
SHA256
b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056
-
SHA512
121a28a34e77f094f0c978cc2085ca9c882e68400f5e63562d850ade62e5eb0d66fa8953562262b08b3226cb3bc5e7cfd94fe4cc2f864dd40f29c621b4f27fa6
-
SSDEEP
1536:T/eA8BQWrI0Scqy/IVjiZUPyE5nMqmRTCkc9x+HejfAclG25DmQT:rchsXpy/iWZ85nIRekciwfDmQT
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1652 Program Files114S2I.exe -
resource yara_rule behavioral1/files/0x0007000000012732-58.dat upx behavioral1/memory/1652-63-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/1652-65-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1668 WScript.Exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\d.ico b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe File opened for modification \??\c:\Program Files\Common Files\t.ico b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001d0103083fb322468db0f3ea82cb9fc70000000002000000000010660000000100002000000087b20e603e3e06b51bbce3116837a25b62a88f9049dc1d1c717423850f96ab96000000000e800000000200002000000031fa91c8052f2a330572575e781d814c27a3bef06e75819cf8e7ca4ceb322b022000000057454459663cccd5032af145426d909b00adc5f109967075feee4ed03c44c25440000000d566a8946e96372d7693ea26db4f1c39b261b70c70a17b4ab960918c203bdc40d69c1e8ff482005d56081702201b33bd19a47b2ede2ef520079631cb0577f378 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001d0103083fb322468db0f3ea82cb9fc7000000000200000000001066000000010000200000007244e62928bc268b306d555e5148df44530b478acd9c0ac5ab5ec64c248776f9000000000e8000000002000020000000542a3c86b7580451a9988ae2f6f9bbaecfe982f5ead0c3478b0c843a76ba7cc890000000c563bc79bb9715d63fd4bcceea80ad724b7ecde7f5a8502985756336127fcbe81f80b6e9136374b072d871f5ade70f0372862971cb8abd1af553dcbbec656895c7fc86f14917488c9f67a59e1decc06356828aed29124b9badfe68a619881cebcaee2ce1002bddbd61d0b89408ee7e212793917fa0c6833fca44f9eea0b9ed8bb38915662fe8a8063b7cd5b23ef72965400000003637e8356055d92e8dba6d0a27fb8ea56a83417e1a752ec2cd0f7a2e7801c63a730e4f925e1f711a2ab8d4a8f1a4ea12638d3f5c9d5d27c9f3f404ff689a70eb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f39904850dd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E49F630-7978-11ED-90F1-D6AAFEFD221A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377544187" iexplore.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hli b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1121" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1121" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\ b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\ b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htb b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\ b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\ b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\ b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.35yes.com/?1121" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1121" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1121" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\ b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1121" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico" b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.h35 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 956 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 1652 Program Files114S2I.exe 956 iexplore.exe 956 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1652 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 27 PID 1164 wrote to memory of 1652 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 27 PID 1164 wrote to memory of 1652 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 27 PID 1164 wrote to memory of 1652 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 27 PID 1652 wrote to memory of 956 1652 Program Files114S2I.exe 29 PID 1652 wrote to memory of 956 1652 Program Files114S2I.exe 29 PID 1652 wrote to memory of 956 1652 Program Files114S2I.exe 29 PID 1652 wrote to memory of 956 1652 Program Files114S2I.exe 29 PID 956 wrote to memory of 1936 956 iexplore.exe 31 PID 956 wrote to memory of 1936 956 iexplore.exe 31 PID 956 wrote to memory of 1936 956 iexplore.exe 31 PID 956 wrote to memory of 1936 956 iexplore.exe 31 PID 1164 wrote to memory of 1668 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 33 PID 1164 wrote to memory of 1668 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 33 PID 1164 wrote to memory of 1668 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 33 PID 1164 wrote to memory of 1668 1164 b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe"C:\Users\Admin\AppData\Local\Temp\b4e56152f8d7bedbc217e9c0401a7abc829d988ae28ff37a32390ac3322c4056.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\Program Files114S2I.exe"c:\Program Files114S2I.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
-
-
-
C:\Windows\SysWOW64\WScript.ExeWScript.Exe jies.bak.vbs2⤵
- Deletes itself
PID:1668
-
Network
-
152 B 3
-
739 B 7.6kB 8 11
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5409a6e08d8d73dd171baa5a76d73a83d
SHA1f1daa273f03066081d5d0102d306afa82f2b58ad
SHA256a7ef14542196e90cc7bc7e71b74fb1bf3ddf6bae0a3b65f0e0e2fda19668c4e1
SHA5129a5e2d66383c320a26c84cd108c546e9bb5936fe373e036a4c983fb09680fac11f98f811fe2d8f053036bc719037e8057a06fdacabbaec1219faf682b30963e0
-
Filesize
486B
MD5e54d1c02c487a883fc9825d3fd8f86d1
SHA1403e8640d815494766e4fb71a447a330aa10c54b
SHA256e5f16a7d0aa26df9c87925c43fbfe051f821d6a0a86efa27ba6b25f662579313
SHA5121873b1e510b6ab557e177b5bc29832286af118fe0b0994a1cc3ab3a275cd6dc1ca77f32772d252a9d58e6573e81b9d8da1c0a045d3fc2c3eb7f9412dfdb7e1bf
-
Filesize
601B
MD578df768f9c0be0da1c710550a370ab8f
SHA19db52d5866d6acd0de385b780738f3ac25d2fe5d
SHA256d5eab7ed7fb56fdfef2761de7e49da65acdea49c229c7f47bfb584116f6dae48
SHA512992681b66e0f4d37b36e0fc6d32fd2a7710d58f3cf2d671d3c3080167d8e95522185bfd8c24219b4162d624f007faf1025cf40fcd8d86a9e44ed9bceaaf7739c