Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/02/2023, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
uiso9_pe.exe
Resource
win7-20221111-en
General
-
Target
uiso9_pe.exe
-
Size
4.9MB
-
MD5
5a2000a241a6947c060ee63425d7ebef
-
SHA1
d80bbe4769b5e00886797d6f7c30063031eb5699
-
SHA256
5f26ba6ce5a487a3c9ec7663143f6d661c5500d0dd593274bd4ab6e78815d236
-
SHA512
cf4155b56d878d1d4c8b18669d6aa700c626fa5b2f67719bb8b2f8378059003046f437ae223a7aef6336d95cb82eeeb057910a432c135bbc4d94619a8bbfde1a
-
SSDEEP
98304:JUj8/4MycvvCf9uOj5zXSdcrRsMZtuS0xbN0yjqnolKIMPgZrx/CpSSMD/zCDK8:Oj3MychOBXSdclsotcYyEGMPqrxo0zCP
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2040 uiso9_pe.tmp 1664 isocmd.exe 1636 UltraISO.exe -
Loads dropped DLL 9 IoCs
pid Process 1716 uiso9_pe.exe 2040 uiso9_pe.tmp 2040 uiso9_pe.tmp 2040 uiso9_pe.tmp 580 regsvr32.exe 2040 uiso9_pe.tmp 2040 uiso9_pe.tmp 2040 uiso9_pe.tmp 1636 UltraISO.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files (x86)\UltraISO\lang\is-GATFI.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-T65KK.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-KO083.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-55UB4.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-1RP2N.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-QH1RC.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-3D0CU.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-M35UJ.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-UE8T0.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-APKKH.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-13QI1.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-SVTDP.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-56TIF.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\unins000.dat uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-0V3K5.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-DD00R.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-P14E4.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-9T213.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-OGI6N.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-7JFRN.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-HJQJN.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-7UHVB.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-4JB3C.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-KQS27.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-0HQG3.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-VS21H.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-FBVL9.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-1LT1R.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-UPSLK.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-LGFM5.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\drivers\is-IBTFP.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-B5ESP.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-QGG0Q.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-E8RKC.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-FN5UR.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-UP81M.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-UCAFF.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-FNIRV.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-KJ2HN.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-P0AKD.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-QTJC7.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-B6FDF.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\drivers\is-MT9TV.tmp uiso9_pe.tmp File opened for modification C:\Program Files (x86)\UltraISO\backup uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\drivers\is-LHLKL.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-LS6G0.tmp uiso9_pe.tmp File created C:\Program Files (x86)\Common Files\EZB Systems\is-VB2DB.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-4LBDT.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-P9NL2.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-KMOC7.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-D43U9.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-RG9P0.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\drivers\is-HLU3P.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\drivers\is-FCP11.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\drivers\is-NGQT1.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-I15PB.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\drivers\is-HSC64.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-RF6HS.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-366R3.tmp uiso9_pe.tmp File opened for modification C:\Program Files (x86)\UltraISO\unins000.dat uiso9_pe.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ui uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\open uiso9_pe.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell uiso9_pe.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\ = "Open with &UltraISO" uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bin uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\Convert to ISO uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers\ISOShell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\binimage uiso9_pe.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\"" uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\UltraISO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\"" uiso9_pe.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\ = "BIN File" uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\UltraISO regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers\ISOShell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\ = "UltraISO File" uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\DefaultIcon uiso9_pe.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ = "IUIContextMenu" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers\ISOShell\ = "{AD392E40-428C-459F-961E-9B147782D099}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\TypeLib\ = "{1CD46142-F3D3-4E46-87BA-7CC019142F9D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.iso\ = "UltraISO" uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltraISO regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UltraISO regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.isz\ = "UltraISO" uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\DefaultIcon uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shell\Convert to ISO\command uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers\ISOShell\ = "{AD392E40-428C-459F-961E-9B147782D099}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CurVer\ = "ISOShell.UIContextMenu.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ProgID\ = "ISOShell.UIContextMenu.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ = "IUIContextMenu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.iso uiso9_pe.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ = "UIContextMenu Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\0\win64\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\CLSID\ = "{AD392E40-428C-459F-961E-9B147782D099}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\ = "ISOShell 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib\Version = "1.0" regsvr32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 632 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 632 AUDIODG.EXE Token: 33 632 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 632 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 2040 uiso9_pe.tmp 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe 1636 UltraISO.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2040 1716 uiso9_pe.exe 28 PID 1716 wrote to memory of 2040 1716 uiso9_pe.exe 28 PID 1716 wrote to memory of 2040 1716 uiso9_pe.exe 28 PID 1716 wrote to memory of 2040 1716 uiso9_pe.exe 28 PID 1716 wrote to memory of 2040 1716 uiso9_pe.exe 28 PID 1716 wrote to memory of 2040 1716 uiso9_pe.exe 28 PID 1716 wrote to memory of 2040 1716 uiso9_pe.exe 28 PID 2040 wrote to memory of 580 2040 uiso9_pe.tmp 29 PID 2040 wrote to memory of 580 2040 uiso9_pe.tmp 29 PID 2040 wrote to memory of 580 2040 uiso9_pe.tmp 29 PID 2040 wrote to memory of 580 2040 uiso9_pe.tmp 29 PID 2040 wrote to memory of 580 2040 uiso9_pe.tmp 29 PID 2040 wrote to memory of 580 2040 uiso9_pe.tmp 29 PID 2040 wrote to memory of 580 2040 uiso9_pe.tmp 29 PID 2040 wrote to memory of 1664 2040 uiso9_pe.tmp 31 PID 2040 wrote to memory of 1664 2040 uiso9_pe.tmp 31 PID 2040 wrote to memory of 1664 2040 uiso9_pe.tmp 31 PID 2040 wrote to memory of 1664 2040 uiso9_pe.tmp 31 PID 2040 wrote to memory of 1636 2040 uiso9_pe.tmp 33 PID 2040 wrote to memory of 1636 2040 uiso9_pe.tmp 33 PID 2040 wrote to memory of 1636 2040 uiso9_pe.tmp 33 PID 2040 wrote to memory of 1636 2040 uiso9_pe.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\is-DSMC4.tmp\uiso9_pe.tmp"C:\Users\Admin\AppData\Local\Temp\is-DSMC4.tmp\uiso9_pe.tmp" /SL5="$70122,4629041,128512,C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:580
-
-
C:\Program Files (x86)\UltraISO\drivers\isocmd.exe"C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -i3⤵
- Executes dropped EXE
PID:1664
-
-
C:\Program Files (x86)\UltraISO\UltraISO.exe"C:\Program Files (x86)\UltraISO\UltraISO.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1636
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5681⤵
- Suspicious use of AdjustPrivilegeToken
PID:632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
962KB
MD5b9e34ae6d6ecb1e19b36dc70e7ef406c
SHA1014985ed2dab57e606e08788fc9177220dd2aed1
SHA2563b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4
SHA512d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
112KB
MD5e489d12ff435aeef4a5474c47d329590
SHA117c353b5748ecd3e8eedd9de347da313085087dc
SHA25666a01f63ee4f66c0cd5bb9bf20e1722d57cc8252ac126780800806b536f4cea9
SHA51226582a140080e64d7f46b83435a8f2444c509e6a5dfaa1fd4adc190824daecfc5464e56ca89cb0518bcec780a1a16700199e567543cea32f32c5ca3e47add2fc
-
Filesize
28KB
MD555677a521dd34ce7a93ab3f1d12b2dfd
SHA14316dd2b5e4ebb48886955ec5365b2f40d4298b3
SHA256fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c
SHA512e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc
-
Filesize
151KB
MD5c0fc6c67bd9d9fbc4f8ad44232d49d11
SHA1e5ad2b56cc20652401ee5c60fe118cf3fb474a7b
SHA25650df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503
SHA51274bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586
-
Filesize
771KB
MD53de2992c86c78e781881e9c0db26a32f
SHA1c26845ca7319a66432304a955cecdad4f977d040
SHA256e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642
SHA51288d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6
-
Filesize
771KB
MD53de2992c86c78e781881e9c0db26a32f
SHA1c26845ca7319a66432304a955cecdad4f977d040
SHA256e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642
SHA51288d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6
-
Filesize
962KB
MD5b9e34ae6d6ecb1e19b36dc70e7ef406c
SHA1014985ed2dab57e606e08788fc9177220dd2aed1
SHA2563b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4
SHA512d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
28KB
MD555677a521dd34ce7a93ab3f1d12b2dfd
SHA14316dd2b5e4ebb48886955ec5365b2f40d4298b3
SHA256fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c
SHA512e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc
-
Filesize
28KB
MD555677a521dd34ce7a93ab3f1d12b2dfd
SHA14316dd2b5e4ebb48886955ec5365b2f40d4298b3
SHA256fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c
SHA512e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc
-
Filesize
151KB
MD5c0fc6c67bd9d9fbc4f8ad44232d49d11
SHA1e5ad2b56cc20652401ee5c60fe118cf3fb474a7b
SHA25650df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503
SHA51274bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586
-
Filesize
782KB
MD5f92f7190cab7f80cbd7f5e419c27e37d
SHA18b26411b33a8727353ac615c11acdfebc34fad80
SHA25682190e1bfe62f4549f3ca2dd76261cc6213968d4f599349d3b07274499223ece
SHA512922ead325d49738ecd3ad93aec573649da5a9082892aeeb63cfdaa0f0c5141844a86bae666b3279303b0b1684e93433b62f734c52c77c94633bd6a508f7480dc
-
Filesize
771KB
MD53de2992c86c78e781881e9c0db26a32f
SHA1c26845ca7319a66432304a955cecdad4f977d040
SHA256e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642
SHA51288d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6