Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2022, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
Resource
win10v2004-20220812-en
General
-
Target
1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
-
Size
2.0MB
-
MD5
53ca26fbcd0c54a9529dde33d5bc2042
-
SHA1
20fd30d5957986143fca7488762e23f97f85d28a
-
SHA256
1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926
-
SHA512
da4275c57f04fbcf3811336a46396ab754a3df91ea25a5ba3d89bf7499cfe700b65ec66ba4a8e4d374283a641e3e0e70aaf2337520e6c56b300693696b2442f6
-
SSDEEP
24576:kxm0iO/DQ3eyqvtsJe30RxVIxplYJ1B3J7hoBTl+mRezac3hWYo7wszC9BPnfCvJ:kA0T/kwKQ0nVe+JGR0nBinx
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\LgYAAcwo\\FyMMUIks.exe," 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\LgYAAcwo\\FyMMUIks.exe," 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 3088 sCsMcEUE.exe 4600 FyMMUIks.exe 4900 MgowMocc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation sCsMcEUE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sCsMcEUE.exe = "C:\\Users\\Admin\\gMEoEUUc\\sCsMcEUE.exe" sCsMcEUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FyMMUIks.exe = "C:\\ProgramData\\LgYAAcwo\\FyMMUIks.exe" FyMMUIks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FyMMUIks.exe = "C:\\ProgramData\\LgYAAcwo\\FyMMUIks.exe" MgowMocc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sCsMcEUE.exe = "C:\\Users\\Admin\\gMEoEUUc\\sCsMcEUE.exe" 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FyMMUIks.exe = "C:\\ProgramData\\LgYAAcwo\\FyMMUIks.exe" 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\gMEoEUUc MgowMocc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\gMEoEUUc\sCsMcEUE MgowMocc.exe File created C:\Windows\SysWOW64\shell32.dll.exe sCsMcEUE.exe File opened for modification C:\Windows\SysWOW64\sheTestSearch.bmp sCsMcEUE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 18 IoCs
pid Process 536 reg.exe 3280 reg.exe 3936 reg.exe 2076 reg.exe 1792 reg.exe 2372 reg.exe 3940 reg.exe 4756 reg.exe 2540 reg.exe 2156 reg.exe 3428 reg.exe 3900 reg.exe 2188 reg.exe 5088 reg.exe 2020 reg.exe 4264 reg.exe 296 reg.exe 4112 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4116 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4116 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4116 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 4116 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 4064 vssvc.exe Token: SeRestorePrivilege 4064 vssvc.exe Token: SeAuditPrivilege 4064 vssvc.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe 3088 sCsMcEUE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 3088 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 82 PID 1524 wrote to memory of 3088 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 82 PID 1524 wrote to memory of 3088 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 82 PID 1524 wrote to memory of 4600 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 83 PID 1524 wrote to memory of 4600 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 83 PID 1524 wrote to memory of 4600 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 83 PID 1524 wrote to memory of 2088 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 85 PID 1524 wrote to memory of 2088 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 85 PID 1524 wrote to memory of 2088 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 85 PID 1524 wrote to memory of 2020 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 88 PID 1524 wrote to memory of 2020 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 88 PID 1524 wrote to memory of 2020 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 88 PID 2088 wrote to memory of 4260 2088 cmd.exe 87 PID 2088 wrote to memory of 4260 2088 cmd.exe 87 PID 2088 wrote to memory of 4260 2088 cmd.exe 87 PID 1524 wrote to memory of 4264 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 91 PID 1524 wrote to memory of 4264 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 91 PID 1524 wrote to memory of 4264 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 91 PID 1524 wrote to memory of 2156 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 90 PID 1524 wrote to memory of 2156 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 90 PID 1524 wrote to memory of 2156 1524 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 90 PID 4260 wrote to memory of 4836 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 97 PID 4260 wrote to memory of 4836 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 97 PID 4260 wrote to memory of 4836 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 97 PID 4260 wrote to memory of 536 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 99 PID 4260 wrote to memory of 536 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 99 PID 4260 wrote to memory of 536 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 99 PID 4260 wrote to memory of 1792 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 100 PID 4260 wrote to memory of 1792 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 100 PID 4260 wrote to memory of 1792 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 100 PID 4260 wrote to memory of 3428 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 102 PID 4260 wrote to memory of 3428 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 102 PID 4260 wrote to memory of 3428 4260 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 102 PID 4836 wrote to memory of 4784 4836 cmd.exe 105 PID 4836 wrote to memory of 4784 4836 cmd.exe 105 PID 4836 wrote to memory of 4784 4836 cmd.exe 105 PID 4784 wrote to memory of 4892 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 107 PID 4784 wrote to memory of 4892 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 107 PID 4784 wrote to memory of 4892 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 107 PID 4892 wrote to memory of 3476 4892 cmd.exe 109 PID 4892 wrote to memory of 3476 4892 cmd.exe 109 PID 4892 wrote to memory of 3476 4892 cmd.exe 109 PID 4784 wrote to memory of 3900 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 110 PID 4784 wrote to memory of 3900 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 110 PID 4784 wrote to memory of 3900 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 110 PID 4784 wrote to memory of 2188 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 111 PID 4784 wrote to memory of 2188 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 111 PID 4784 wrote to memory of 2188 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 111 PID 4784 wrote to memory of 296 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 112 PID 4784 wrote to memory of 296 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 112 PID 4784 wrote to memory of 296 4784 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 112 PID 3476 wrote to memory of 4868 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 116 PID 3476 wrote to memory of 4868 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 116 PID 3476 wrote to memory of 4868 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 116 PID 4868 wrote to memory of 4116 4868 cmd.exe 118 PID 4868 wrote to memory of 4116 4868 cmd.exe 118 PID 4868 wrote to memory of 4116 4868 cmd.exe 118 PID 3476 wrote to memory of 5088 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 119 PID 3476 wrote to memory of 5088 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 119 PID 3476 wrote to memory of 5088 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 119 PID 3476 wrote to memory of 2372 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 120 PID 3476 wrote to memory of 2372 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 120 PID 3476 wrote to memory of 2372 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 120 PID 3476 wrote to memory of 4112 3476 1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe"C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\gMEoEUUc\sCsMcEUE.exe"C:\Users\Admin\gMEoEUUc\sCsMcEUE.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3088
-
-
C:\ProgramData\LgYAAcwo\FyMMUIks.exe"C:\ProgramData\LgYAAcwo\FyMMUIks.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"2⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exeC:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c9263⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"4⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exeC:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c9265⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"6⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exeC:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c9267⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"8⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exeC:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c9269⤵
- Suspicious behavior: EnumeratesProcesses
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"10⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exeC:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c92611⤵PID:3584
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3940
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
PID:3936
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
PID:2076
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4756
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
PID:3280
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
PID:2540
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:5088
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
PID:2372
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
PID:4112
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3900
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
PID:2188
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
PID:296
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:536
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
PID:1792
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
PID:3428
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2020
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
PID:2156
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:4264
-
-
C:\ProgramData\YmEMwEIo\MgowMocc.exeC:\ProgramData\YmEMwEIo\MgowMocc.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4900
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD59825480e14903e5c8ac443caed12e533
SHA19e079e1c6b5cbd5c3ae74c799dc0975a264adff3
SHA256a40da433c2ca1516990a8d231326abc0f94e59c626b68b889c5e5a780c5c823f
SHA512e76a20d7f5ce3149ac035fb68b4380b238cc15fa03b9ccaab2f9ccbf0e6f2861b7228feffc917134544c30c1da7fc91704b765e918f9dc0d909506dca4ce8ca4
-
Filesize
2.0MB
MD59825480e14903e5c8ac443caed12e533
SHA19e079e1c6b5cbd5c3ae74c799dc0975a264adff3
SHA256a40da433c2ca1516990a8d231326abc0f94e59c626b68b889c5e5a780c5c823f
SHA512e76a20d7f5ce3149ac035fb68b4380b238cc15fa03b9ccaab2f9ccbf0e6f2861b7228feffc917134544c30c1da7fc91704b765e918f9dc0d909506dca4ce8ca4
-
Filesize
1.9MB
MD581029efe0d04ebd9a2725274e447e9ee
SHA113304c1b0b2114500af27b4bcbc6aafec521f4a3
SHA2560e52cb3dbd60db20606e53efd002b7e3414d81784ba2f8e5f5bd7d1fab2f1173
SHA5122b67fe9edf340c00e355fa0765f8b90015bde72d980dbccdbbee303be02e4f4b192f5777536287540b18892b34df80ee9ce6fe7ce50afe0063010278ca3988c6
-
Filesize
1.9MB
MD581029efe0d04ebd9a2725274e447e9ee
SHA113304c1b0b2114500af27b4bcbc6aafec521f4a3
SHA2560e52cb3dbd60db20606e53efd002b7e3414d81784ba2f8e5f5bd7d1fab2f1173
SHA5122b67fe9edf340c00e355fa0765f8b90015bde72d980dbccdbbee303be02e4f4b192f5777536287540b18892b34df80ee9ce6fe7ce50afe0063010278ca3988c6
-
Filesize
6KB
MD51faaca27db89108e4db71601f485ec34
SHA10ba4ef92a3a4aa61bcc8be95e8353c7cca84855c
SHA256938302353d9e5e040c36fb429ab96cd61b4e0948d1c6c027767f8ae00dc62171
SHA512bd05d1a2d40a74d8049049b59c9bb6b6f99b3af0d115d5a14b8c83f8af3567b4e416517027001876821677d6464a6b3f343fd9adbf28bd196b6da97a56a9a97a
-
Filesize
6KB
MD51faaca27db89108e4db71601f485ec34
SHA10ba4ef92a3a4aa61bcc8be95e8353c7cca84855c
SHA256938302353d9e5e040c36fb429ab96cd61b4e0948d1c6c027767f8ae00dc62171
SHA512bd05d1a2d40a74d8049049b59c9bb6b6f99b3af0d115d5a14b8c83f8af3567b4e416517027001876821677d6464a6b3f343fd9adbf28bd196b6da97a56a9a97a
-
Filesize
6KB
MD51faaca27db89108e4db71601f485ec34
SHA10ba4ef92a3a4aa61bcc8be95e8353c7cca84855c
SHA256938302353d9e5e040c36fb429ab96cd61b4e0948d1c6c027767f8ae00dc62171
SHA512bd05d1a2d40a74d8049049b59c9bb6b6f99b3af0d115d5a14b8c83f8af3567b4e416517027001876821677d6464a6b3f343fd9adbf28bd196b6da97a56a9a97a
-
Filesize
6KB
MD51faaca27db89108e4db71601f485ec34
SHA10ba4ef92a3a4aa61bcc8be95e8353c7cca84855c
SHA256938302353d9e5e040c36fb429ab96cd61b4e0948d1c6c027767f8ae00dc62171
SHA512bd05d1a2d40a74d8049049b59c9bb6b6f99b3af0d115d5a14b8c83f8af3567b4e416517027001876821677d6464a6b3f343fd9adbf28bd196b6da97a56a9a97a
-
Filesize
2.0MB
MD59b590740ec6a57953a735ee85673376c
SHA147dc62768ad20238f026e0a1b742804f4c974848
SHA25660a0dfa4e97220b0657dd6fc47d32dd47eb154d92c93b696c24db6f03a230ba6
SHA512c912ca31374325b6af222818bad7b6129f1a4e017355f797b4ef0100fda06357f6c2105dc0fdf958d84dcbc2ed1640dab6953ce70465b4cb130fbf8ac5f97587
-
Filesize
2.0MB
MD59b590740ec6a57953a735ee85673376c
SHA147dc62768ad20238f026e0a1b742804f4c974848
SHA25660a0dfa4e97220b0657dd6fc47d32dd47eb154d92c93b696c24db6f03a230ba6
SHA512c912ca31374325b6af222818bad7b6129f1a4e017355f797b4ef0100fda06357f6c2105dc0fdf958d84dcbc2ed1640dab6953ce70465b4cb130fbf8ac5f97587