Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe
Resource
win7-20221111-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe
-
Size
826KB
-
MD5
19e6603fc037cd1267556ac92056cb40
-
SHA1
6dd367c5427f304f86324584bcfdb32add14049e
-
SHA256
7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b
-
SHA512
db408f2efecf18a04580badf50ea58e92918b4eab622f1d0a7688672203e4008e9d51c7e2fdd293d09cd6c0e5c9cf5cbe72c6c27d5df6ac2c1e1f5e17c8b19b5
-
SSDEEP
1536:VT7kWlngkYFKynXvAh1MFOMLwOueYdqXhVBZXcMik421dNSkWNVYM3O3:VMQgk6Kyn/wMFOMLN9AQdjWzT+
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 44F3E2.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\67F8E5B2D4DDFE2F\44F3E2.exe = "C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe:*:Enabled:@xpsp2res.dll,-28956246" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\67F8E5B2D4DDFE2F\44F3E2.exe = "C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe:*:Enabled:@xpsp2res.dll,-57951861" 44F3E2.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 44F3E2.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\67F8E5B2D4DDFE2F\44F3E2.exe = "C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe:*:Enabled:@xpsp2res.dll,-70554750" 44F3E2.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\67F8E5B2D4DDFE2F\44F3E2.exe = "C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe:*:Enabled:@xpsp2res.dll,-53342401" 44F3E2.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" 44F3E2.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3" 44F3E2.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 44F3E2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1" 44F3E2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 44F3E2.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 44F3E2.exe -
Disables Task Manager via registry modification
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 2 IoCs
pid Process 1176 44F3E2.exe 612 44F3E2.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GenericRenosFix.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieRpcSs.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\popscan.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pview95.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taumon.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe 44F3E2.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPUB.EXE 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccpfw.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmoon.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe 44F3E2.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOXMLED.EXE 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxw.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drweb32.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srwatch.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcdsetup.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exit.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_findviru.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmor.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iris.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SandboxieBITS.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fssm32.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fa-setup.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iomon98.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrp-421-en-win.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitornt.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notstart.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccntmon.exe 44F3E2.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IELOWUTIL.EXE 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmavsp.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zauinst.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navrunr.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kis8.0.0.506latam.exe 44F3E2.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETLANG.EXE 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defscangui.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdclt.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir-help.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alerter.exe 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drvins32.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netutils.exe 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serv95.exe\Debugger = "\"C:\\Users\\Admin\\67F8E5B2D4DDFE2F\\44F3E2.exe\"" 44F3E2.exe -
resource yara_rule behavioral1/memory/864-54-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/864-57-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/864-58-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/864-61-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/864-70-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/612-80-0x0000000000400000-0x000000000043D000-memory.dmp upx -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Anytime Upgrade.exe 44F3E2.exe -
Loads dropped DLL 2 IoCs
pid Process 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpyWareDisableNotify = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "1" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\cval = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "1" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall 44F3E2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44F3E2.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 944 set thread context of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 1176 set thread context of 612 1176 44F3E2.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Sound 44F3E2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Sound\Beep = "no" 44F3E2.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://u4wba791f3ly8fg.directorio-w.com" 44F3E2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://1zw79i2t99meqn8.directorio-w.com" 44F3E2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" 44F3E2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://370u355h3c4hon7.directorio-w.com" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://9621k2d33hs4el9.directorio-w.com" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://4u26di6ti4uv2t9.directorio-w.com" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://24mlh17mp5st846.directorio-w.com" 44F3E2.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Download 44F3E2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "Yes" 44F3E2.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main 44F3E2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://b4oy0ev0nwa1ln1.directorio-w.com" 44F3E2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://6qtgt18nc3gc359.directorio-w.com" 44F3E2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1" 44F3E2.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main 44F3E2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no" 44F3E2.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://2qgcm17li3ymq25.directorio-w.com" 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://0gxn86l3327p062.directorio-w.com" 44F3E2.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application\ = "IExplore" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application\ = "IExplore" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\ddeexec\Application 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\"" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec 44F3E2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\ddeexec\Application\ = "IExplore" 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http 44F3E2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec 44F3E2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 612 44F3E2.exe 612 44F3E2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeBackupPrivilege 612 44F3E2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 612 44F3E2.exe 612 44F3E2.exe 612 44F3E2.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 944 wrote to memory of 864 944 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 28 PID 864 wrote to memory of 1344 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 29 PID 864 wrote to memory of 1344 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 29 PID 864 wrote to memory of 1344 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 29 PID 864 wrote to memory of 1344 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 29 PID 864 wrote to memory of 1176 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 30 PID 864 wrote to memory of 1176 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 30 PID 864 wrote to memory of 1176 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 30 PID 864 wrote to memory of 1176 864 7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe 30 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 1176 wrote to memory of 612 1176 44F3E2.exe 31 PID 612 wrote to memory of 512 612 44F3E2.exe 32 PID 612 wrote to memory of 512 612 44F3E2.exe 32 PID 612 wrote to memory of 512 612 44F3E2.exe 32 PID 612 wrote to memory of 512 612 44F3E2.exe 32 PID 612 wrote to memory of 1268 612 44F3E2.exe 10 PID 612 wrote to memory of 1268 612 44F3E2.exe 10 PID 612 wrote to memory of 1268 612 44F3E2.exe 10 PID 612 wrote to memory of 1268 612 44F3E2.exe 10 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 44F3E2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0" 44F3E2.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe"C:\Users\Admin\AppData\Local\Temp\7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe"C:\Users\Admin\AppData\Local\Temp\7d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b.exe"3⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:1344
-
-
C:\Users\Admin\67F8E5B2D4DDFE2F\44F3E2.exe"C:\Users\Admin\67F8E5B2D4DDFE2F\44F3E2.exe" BBDAD1424⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\67F8E5B2D4DDFE2F\44F3E2.exeBBDAD1425⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Windows security modification
- Checks whether UAC is enabled
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:612 -
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵PID:512
-
-
-
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
826KB
MD519e6603fc037cd1267556ac92056cb40
SHA16dd367c5427f304f86324584bcfdb32add14049e
SHA2567d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b
SHA512db408f2efecf18a04580badf50ea58e92918b4eab622f1d0a7688672203e4008e9d51c7e2fdd293d09cd6c0e5c9cf5cbe72c6c27d5df6ac2c1e1f5e17c8b19b5
-
Filesize
826KB
MD519e6603fc037cd1267556ac92056cb40
SHA16dd367c5427f304f86324584bcfdb32add14049e
SHA2567d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b
SHA512db408f2efecf18a04580badf50ea58e92918b4eab622f1d0a7688672203e4008e9d51c7e2fdd293d09cd6c0e5c9cf5cbe72c6c27d5df6ac2c1e1f5e17c8b19b5
-
Filesize
826KB
MD519e6603fc037cd1267556ac92056cb40
SHA16dd367c5427f304f86324584bcfdb32add14049e
SHA2567d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b
SHA512db408f2efecf18a04580badf50ea58e92918b4eab622f1d0a7688672203e4008e9d51c7e2fdd293d09cd6c0e5c9cf5cbe72c6c27d5df6ac2c1e1f5e17c8b19b5
-
Filesize
826KB
MD519e6603fc037cd1267556ac92056cb40
SHA16dd367c5427f304f86324584bcfdb32add14049e
SHA2567d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b
SHA512db408f2efecf18a04580badf50ea58e92918b4eab622f1d0a7688672203e4008e9d51c7e2fdd293d09cd6c0e5c9cf5cbe72c6c27d5df6ac2c1e1f5e17c8b19b5
-
Filesize
826KB
MD519e6603fc037cd1267556ac92056cb40
SHA16dd367c5427f304f86324584bcfdb32add14049e
SHA2567d380425d00f842364237ae5e2141ed1a11f95857ee7835fefdd3b4d1b61789b
SHA512db408f2efecf18a04580badf50ea58e92918b4eab622f1d0a7688672203e4008e9d51c7e2fdd293d09cd6c0e5c9cf5cbe72c6c27d5df6ac2c1e1f5e17c8b19b5