Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 02:24
Static task
static1
Behavioral task
behavioral1
Sample
edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe
-
Size
320KB
-
MD5
021ec433535004ae16febe9b8f8acf6f
-
SHA1
8b7b9f21e5be29465e62b3e4a3fe54bf6b38df3a
-
SHA256
edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e
-
SHA512
49976d2ab3c9315026fd95804cae799a65ceb64d229de64c84613b4b1ef31e35488e8bda26555c32bde19a25541ec795b70680d7946aeb880bd9e55bf79cfcaf
-
SSDEEP
6144:eTw4o1IV3puaibGKFHi0mofhaH05kipz016580bHFMWu86JQPDHDdx/QtqR:gmgvmzFHi0mo5aH0qMzd5807FKPJQPDV
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tjoucgo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tjoucgo.exe -
Adds policy Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\frs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjbupgbskhtrlkeiwfcf.exe" tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gvzelo = "tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\frs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzoewkcqfziduqhit.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gvzelo = "vzsmiawohfsrmmhmbljng.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\frs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijzqjyrgwrbxpmegsz.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\frs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\frs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gvzelo = "zzoewkcqfziduqhit.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gvzelo = "tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gvzelo = "vzsmiawohfsrmmhmbljng.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\frs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzoewkcqfziduqhit.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gvzelo = "ijzqjyrgwrbxpmegsz.exe" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\frs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjbupgbskhtrlkeiwfcf.exe" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gvzelo = "srfulypcqjrlbwmm.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\frs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijzqjyrgwrbxpmegsz.exe" tjoucgo.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjoucgo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjoucgo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjoucgo.exe -
Executes dropped EXE 2 IoCs
pid Process 936 tjoucgo.exe 1748 tjoucgo.exe -
Loads dropped DLL 4 IoCs
pid Process 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sltcnufmuh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzbe = "gjbupgbskhtrlkeiwfcf.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjoucgo = "ijzqjyrgwrbxpmegsz.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjoucgo = "gjbupgbskhtrlkeiwfcf.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzbe = "vzsmiawohfsrmmhmbljng.exe" tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sltcnufmuh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzoewkcqfziduqhit.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zrygqwgmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvmeyoiyplwtmkdgtbx.exe ." tjoucgo.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijzqjyrgwrbxpmegsz.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zrygqwgmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjoucgo = "tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzbe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\izfmvajo = "vzsmiawohfsrmmhmbljng.exe ." edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjoucgo = "ijzqjyrgwrbxpmegsz.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "gjbupgbskhtrlkeiwfcf.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzbe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvmeyoiyplwtmkdgtbx.exe ." edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sltcnufmuh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzsmiawohfsrmmhmbljng.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zrygqwgmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjbupgbskhtrlkeiwfcf.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\izfmvajo = "ijzqjyrgwrbxpmegsz.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zrygqwgmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe ." edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "tvmeyoiyplwtmkdgtbx.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzbe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjbupgbskhtrlkeiwfcf.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "ijzqjyrgwrbxpmegsz.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "ijzqjyrgwrbxpmegsz.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzbe = "tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\izfmvajo = "srfulypcqjrlbwmm.exe ." tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzbe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzbe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzoewkcqfziduqhit.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijzqjyrgwrbxpmegsz.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzbe = "gjbupgbskhtrlkeiwfcf.exe" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zrygqwgmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zrygqwgmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzoewkcqfziduqhit.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzbe = "tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sltcnufmuh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjoucgo = "tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjoucgo = "gjbupgbskhtrlkeiwfcf.exe" tjoucgo.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srfulypcqjrlbwmm.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\izfmvajo = "vzsmiawohfsrmmhmbljng.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\izfmvajo = "zzoewkcqfziduqhit.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\izfmvajo = "ijzqjyrgwrbxpmegsz.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\izfmvajo = "tvmeyoiyplwtmkdgtbx.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "gjbupgbskhtrlkeiwfcf.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjoucgo = "zzoewkcqfziduqhit.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "zzoewkcqfziduqhit.exe ." tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sltcnufmuh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjbupgbskhtrlkeiwfcf.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sltcnufmuh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvmeyoiyplwtmkdgtbx.exe" tjoucgo.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzbe = "zzoewkcqfziduqhit.exe" tjoucgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sltcnufmuh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzsmiawohfsrmmhmbljng.exe" tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjoucgo = "tvmeyoiyplwtmkdgtbx.exe" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzbe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvmeyoiyplwtmkdgtbx.exe" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzoewkcqfziduqhit.exe ." tjoucgo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vjmqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzsmiawohfsrmmhmbljng.exe ." tjoucgo.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zrygqwgmt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvmeyoiyplwtmkdgtbx.exe ." tjoucgo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjoucgo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjoucgo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tjoucgo.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 whatismyipaddress.com 7 www.showmyipaddress.com 14 whatismyip.everdot.org -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vjmqwyegjroxcmrgfzhvycikqsv.ajo tjoucgo.exe File created C:\Windows\SysWOW64\vjmqwyegjroxcmrgfzhvycikqsv.ajo tjoucgo.exe File opened for modification C:\Windows\SysWOW64\srfulypcqjrlbwmmwbuthwnaresltndyooydwv.ypc tjoucgo.exe File created C:\Windows\SysWOW64\srfulypcqjrlbwmmwbuthwnaresltndyooydwv.ypc tjoucgo.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\srfulypcqjrlbwmmwbuthwnaresltndyooydwv.ypc tjoucgo.exe File created C:\Program Files (x86)\srfulypcqjrlbwmmwbuthwnaresltndyooydwv.ypc tjoucgo.exe File opened for modification C:\Program Files (x86)\vjmqwyegjroxcmrgfzhvycikqsv.ajo tjoucgo.exe File created C:\Program Files (x86)\vjmqwyegjroxcmrgfzhvycikqsv.ajo tjoucgo.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\vjmqwyegjroxcmrgfzhvycikqsv.ajo tjoucgo.exe File created C:\Windows\vjmqwyegjroxcmrgfzhvycikqsv.ajo tjoucgo.exe File opened for modification C:\Windows\srfulypcqjrlbwmmwbuthwnaresltndyooydwv.ypc tjoucgo.exe File created C:\Windows\srfulypcqjrlbwmmwbuthwnaresltndyooydwv.ypc tjoucgo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1748 tjoucgo.exe 1748 tjoucgo.exe 1748 tjoucgo.exe 1748 tjoucgo.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1748 tjoucgo.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1776 wrote to memory of 936 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 28 PID 1776 wrote to memory of 936 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 28 PID 1776 wrote to memory of 936 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 28 PID 1776 wrote to memory of 936 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 28 PID 1776 wrote to memory of 1748 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 29 PID 1776 wrote to memory of 1748 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 29 PID 1776 wrote to memory of 1748 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 29 PID 1776 wrote to memory of 1748 1776 edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe 29 -
System policy modification 1 TTPs 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tjoucgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjoucgo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tjoucgo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe"C:\Users\Admin\AppData\Local\Temp\edd4c9dad9784b6ba842872d275d6ac92965702e58dc70d23d78ae2a97f4699e.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\tjoucgo.exe"C:\Users\Admin\AppData\Local\Temp\tjoucgo.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:936
-
-
C:\Users\Admin\AppData\Local\Temp\tjoucgo.exe"C:\Users\Admin\AppData\Local\Temp\tjoucgo.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1748
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720KB
MD52bb0e31e2bb094c147cff5390fda71bd
SHA17ed366285da0a381aab36c2e090c9c9338fca703
SHA2569744bfc2d43dc2d6e85f1eb9baa2c3f368dc10153cbed693eaaae4b83a3d7498
SHA5128d181808a8f1bd30cd34a0545ec73f99075117eae9ee22217d5ebb92f113a7cbb912569db28def77efdea3813eafeec4e76429c5c307974835b29de48776e7c9
-
Filesize
720KB
MD52bb0e31e2bb094c147cff5390fda71bd
SHA17ed366285da0a381aab36c2e090c9c9338fca703
SHA2569744bfc2d43dc2d6e85f1eb9baa2c3f368dc10153cbed693eaaae4b83a3d7498
SHA5128d181808a8f1bd30cd34a0545ec73f99075117eae9ee22217d5ebb92f113a7cbb912569db28def77efdea3813eafeec4e76429c5c307974835b29de48776e7c9
-
Filesize
720KB
MD52bb0e31e2bb094c147cff5390fda71bd
SHA17ed366285da0a381aab36c2e090c9c9338fca703
SHA2569744bfc2d43dc2d6e85f1eb9baa2c3f368dc10153cbed693eaaae4b83a3d7498
SHA5128d181808a8f1bd30cd34a0545ec73f99075117eae9ee22217d5ebb92f113a7cbb912569db28def77efdea3813eafeec4e76429c5c307974835b29de48776e7c9
-
Filesize
720KB
MD52bb0e31e2bb094c147cff5390fda71bd
SHA17ed366285da0a381aab36c2e090c9c9338fca703
SHA2569744bfc2d43dc2d6e85f1eb9baa2c3f368dc10153cbed693eaaae4b83a3d7498
SHA5128d181808a8f1bd30cd34a0545ec73f99075117eae9ee22217d5ebb92f113a7cbb912569db28def77efdea3813eafeec4e76429c5c307974835b29de48776e7c9
-
Filesize
720KB
MD52bb0e31e2bb094c147cff5390fda71bd
SHA17ed366285da0a381aab36c2e090c9c9338fca703
SHA2569744bfc2d43dc2d6e85f1eb9baa2c3f368dc10153cbed693eaaae4b83a3d7498
SHA5128d181808a8f1bd30cd34a0545ec73f99075117eae9ee22217d5ebb92f113a7cbb912569db28def77efdea3813eafeec4e76429c5c307974835b29de48776e7c9
-
Filesize
720KB
MD52bb0e31e2bb094c147cff5390fda71bd
SHA17ed366285da0a381aab36c2e090c9c9338fca703
SHA2569744bfc2d43dc2d6e85f1eb9baa2c3f368dc10153cbed693eaaae4b83a3d7498
SHA5128d181808a8f1bd30cd34a0545ec73f99075117eae9ee22217d5ebb92f113a7cbb912569db28def77efdea3813eafeec4e76429c5c307974835b29de48776e7c9