Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 10:31
Behavioral task
behavioral1
Sample
6774a06aa7558fce73fa53d9558eb7a3.exe
Resource
win7-20231215-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
6774a06aa7558fce73fa53d9558eb7a3.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
6774a06aa7558fce73fa53d9558eb7a3.exe
-
Size
49KB
-
MD5
6774a06aa7558fce73fa53d9558eb7a3
-
SHA1
c8d3eb76606c9bd79c663fcaa69cadd9a13996a1
-
SHA256
c1bbd17d3f641e494bc0a6808b74365ca93ebaf82b7a4675a50ed6f11724e562
-
SHA512
eb8523f720e40d4d49669a486de143750d309d7ff6b3bd84ec7140565bf575e65434fd279219c4c08b776109330dfad90a82b26421148c02d3927705f2ecf745
-
SSDEEP
1536:g7t7m5dUyHatEMwlYFCajqyBY+s7tp6o2oeqfRAY:gh7m5ahAMY+Ypn1eqfz
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2932 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2724 conime.exe -
Loads dropped DLL 6 IoCs
pid Process 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 2724 conime.exe 2724 conime.exe 2724 conime.exe 596 regsvr32.exe -
resource yara_rule behavioral1/memory/2164-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2164-6-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2164-72-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2164-568-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\google = "c:\\windows\\mybar\\conime.exe " reg.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\ = "??????" regedit.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Maxthon2\SharedAccount\Config\MxSpeedDial\SpeedDial.ini WScript.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\4\iecollectionOld.vbe 6774a06aa7558fce73fa53d9558eb7a3.exe File created C:\Windows\search.reg WScript.exe File created C:\Windows\ShowIeLinkIe6.reg WScript.exe File created C:\Windows\SetWindowsIndex.reg WScript.exe File opened for modification C:\Windows\mybar\conime.exe 6774a06aa7558fce73fa53d9558eb7a3.exe File opened for modification C:\Windows\7\indexOlds.vbe 6774a06aa7558fce73fa53d9558eb7a3.exe File opened for modification C:\Windows\0\8.dll 6774a06aa7558fce73fa53d9558eb7a3.exe File created C:\Windows\reg.reg 6774a06aa7558fce73fa53d9558eb7a3.exe File opened for modification C:\Windows\7\searchOld.vbe 6774a06aa7558fce73fa53d9558eb7a3.exe File created C:\Windows\WindowsMy.reg 6774a06aa7558fce73fa53d9558eb7a3.exe File created C:\Windows\ShowIeLinkIe7.reg WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 6774a06aa7558fce73fa53d9558eb7a3.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\mylovewebs.com\Total = "63" 6774a06aa7558fce73fa53d9558eb7a3.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000 regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CEF59996-ACD3-43B5-80AA-FAAA6CDD98DE}\URL = "http://www.mylovewebs.com/api/sogou/so.htm?word={searchTerms}" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CEF59996-ACD3-43B5-80AA-FAAA6CDD98DE}\SortIndex = "5" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\URL = "http://www.mylovewebs.com/api/taobao/so.htm?word={searchTerms}" regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 65cf80b551e1c349b73f70b13fca8e86 regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\SortIndex = "2" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000196afb90ecad21dd6a6f1c3b40069e0a454f75aa5139d80a7fe3eeaf904f49cc000000000e80000000020000200000002b2c2a97dc0f44013862690b708da5b6b415a07486199e175ea43f112bdbe804200000003b34e02f853b66e6764d06a7bcc93b61f3cf44c6b6e3e7461da368412ca7b091400000003353256e2e149f1c2dbd33847df890ed9b7d36eb484df9d8528fdf3e5da83304282e1dd6e09a499c9cf74a804a3eed721f43090042b716e88d1228a1d7089c09 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00cd7b2ff038da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\mylovewebs.com\NumberOfSubdomains = "1" 6774a06aa7558fce73fa53d9558eb7a3.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mylovewebs.com 6774a06aa7558fce73fa53d9558eb7a3.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\mylovewebs.com 6774a06aa7558fce73fa53d9558eb7a3.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main conime.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000340000001b000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005812307c340a606a618ea2b31ea06608b57995c55f96b48111dd219ec8132ae1000000000e8000000002000020000000af1d13f4680243aa7bd885b781d752ffd58876973c4cf73444936282dff6601c500000005b456221e957255e95ad9e969d222eb7c6256e8a32bbd1118fa49be3cc3c9981aa5b1938c6c8a3dbf3aefb2dead51a8537db9885fea0340921d0ade986488adb7f1217c504ffdd420a221632cd98148540000000e1188dfa2b6f0e863bfc07995031938357f296eec2513bd4578a63bc0badc51ee7c04668a2fcc46ab87e589cf5ffd2a2ad4da6afc40ad73a5df78cf81dbeb04f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000 regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000030000002003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 6774a06aa7558fce73fa53d9558eb7a3.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000b1e0edf8818bf9182378a79da4aa9437d64a16ca4b3a678e465b456193349aaf000000000e8000000002000020000000140b44215a0afe6ffe4cb9e8b4e4fce9af1827120c5cd60b4a5705259a2b57d290000000fdd516c2890f2ad30a8da9b3c2c515fb7329eb14a78d43cb3983bb86d90068699360b4cb09e5ae4848fc8c2035bd4099bfe4fed9436e54d5bbd8196b77cefdfdc925c661974a26a9986e0ce6330356897e82c5d565ca91cc2e0b4b8ce48aa5afbcf6547716d941be42c27312466592348539972c89d840cc2a0d154081e4cbe38ce64a3b044a06eec7e48068f6bf8bc340000000e034560e15d3417b7be53f792f71a24c17f65cd6e014d7ec605dec669e3bdccf2a5d97a6b9f485aab994d7db15efb748a134e6a916ed620fbff2b45f74c30fe4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409862565" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\Explorer\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CEF59996-ACD3-43B5-80AA-FAAA6CDD98DE}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{CEF59996-ACD3-43B5-80AA-FAAA6CDD98DE}.ico" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 6774a06aa7558fce73fa53d9558eb7a3.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\LinksFolderName = "Á´½Ó" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\Explorer regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000030000000140000002a000000010000008006000080010000030000008102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage 6774a06aa7558fce73fa53d9558eb7a3.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total 6774a06aa7558fce73fa53d9558eb7a3.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mylovewebs.com\ = "63" 6774a06aa7558fce73fa53d9558eb7a3.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c00000000000004681000000100000009ed10ec233ecca01e61abf65c5edca019ed10ec233ecca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c00310000000000a53c284a1000444f43554d457e310000440003000400efbea53c1249a73cf1481400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a63c8e0c100041444d494e497e310000320003000400efbea53c284aa73cf14814000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a63c760f11004641564f52497e3100003e0003000400efbea53c284aa73c3344140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a53c294a1000fe94a56300001c0003000400efbea53c294aa73c334414000000fe94a56300001400000060000000030000a0580000000000000068792d3636796c7032363264663675000ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e00026180888870ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e000261808888700000000 regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}.ico" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CEF59996-ACD3-43B5-80AA-FAAA6CDD98DE}\FaviconURL = "http://www.sogou.com/favicon.ico" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E} regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CEF59996-ACD3-43B5-80AA-FAAA6CDD98DE}\DisplayName = "Ëѹ·" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200} regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c0000000000000468100000010000000feb8496527bbc90112c0b16e27bbc9015aac066827bbc9010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008c3acb231000444f43554d457e310000440003000400efbe8c3ada218c3acb231400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a003100000000008c3acc23100041444d494e497e310000320003000400efbe8c3acb238c3acc2314000000410064006d0069006e006900730074007200610074006f0072000000180056003100000000008c3ace2311004641564f52497e3100003e0003000400efbe8c3acb238c3ace23140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d313236393300180030003500000000008c3acf231000fe94a56300001c0003000400efbe8c3acc238c3acf2314000000fe94a56300001400000060000000030000a0580000000000000067686f73747870332d3436373638300008fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa208fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa200000000 regedit.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006200000001000000a0060000a00f000005000000220400002600000002000000a10600006001000004000000a1000000c600000003000000a1020000d4040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\DisplayName = "°Ù¶Èһϣ¬Äã¾ÍÖªµÀ" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{E140FB5B-2A9D-4FA4-A20F-089B92412200}.ico" regedit.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.dianxin.cn?292" regedit.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\VERSION\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\??(&R)\Command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\ = "00.00.00.00" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\ = "QvodAdBlocker.QvodBlock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\InprocServer32\ = "C:\\Windows\\0\\8.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\??(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\??(&R) regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\TypeLib\ = "{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock\Clsid\ = "{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shdocvw.dll" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\InProcServer32 regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.dianxin.cn?292" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\TypeLib\ = "{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\TypeLib\ = "{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\ProgID\ = "QvodAdBlocker.QvodBlock" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\ = "????(&H)" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock\ = "QvodAdBlocker.QvodBlock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\ = "QvodBlock" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command\ = "Rundll32.exe" regedit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\Attributes = 00000000 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0\ = "QvodAdBlocker" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\ = "_QvodBlock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0\0\win32\ = "C:\\Windows\\0\\8.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0\HELPDIR\ = "C:\\Windows\\0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BC93541-1831-46BD-AEDE-DB1DD8B24AED}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E3F489-F4B0-40FA-859D-9B988031E416}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B06F17B4-BCAA-43EF-A422-F2481A1E8BA8}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ = "Internet Explorer" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\ = "??(&D)" regedit.exe -
Runs .reg file with regedit 6 IoCs
pid Process 1880 regedit.exe 2764 regedit.exe 308 regedit.exe 524 regedit.exe 1404 regedit.exe 2768 regedit.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2164 6774a06aa7558fce73fa53d9558eb7a3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2164 6774a06aa7558fce73fa53d9558eb7a3.exe Token: SeBackupPrivilege 2164 6774a06aa7558fce73fa53d9558eb7a3.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1968 iexplore.exe 1968 iexplore.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 2724 conime.exe 2724 conime.exe 2724 conime.exe 1968 iexplore.exe 1968 iexplore.exe 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1968 iexplore.exe 1968 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2724 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 30 PID 2164 wrote to memory of 2724 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 30 PID 2164 wrote to memory of 2724 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 30 PID 2164 wrote to memory of 2724 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 30 PID 2164 wrote to memory of 2724 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 30 PID 2164 wrote to memory of 2724 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 30 PID 2164 wrote to memory of 2724 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 30 PID 2164 wrote to memory of 1964 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 31 PID 2164 wrote to memory of 1964 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 31 PID 2164 wrote to memory of 1964 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 31 PID 2164 wrote to memory of 1964 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 31 PID 2164 wrote to memory of 1964 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 31 PID 2164 wrote to memory of 1964 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 31 PID 2164 wrote to memory of 1964 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 31 PID 2164 wrote to memory of 596 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 32 PID 2164 wrote to memory of 596 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 32 PID 2164 wrote to memory of 596 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 32 PID 2164 wrote to memory of 596 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 32 PID 2164 wrote to memory of 596 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 32 PID 2164 wrote to memory of 596 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 32 PID 2164 wrote to memory of 596 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 32 PID 2164 wrote to memory of 2952 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 33 PID 2164 wrote to memory of 2952 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 33 PID 2164 wrote to memory of 2952 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 33 PID 2164 wrote to memory of 2952 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 33 PID 2164 wrote to memory of 2952 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 33 PID 2164 wrote to memory of 2952 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 33 PID 2164 wrote to memory of 2952 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 33 PID 2164 wrote to memory of 2960 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 35 PID 2164 wrote to memory of 2960 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 35 PID 2164 wrote to memory of 2960 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 35 PID 2164 wrote to memory of 2960 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 35 PID 2164 wrote to memory of 2960 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 35 PID 2164 wrote to memory of 2960 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 35 PID 2164 wrote to memory of 2960 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 35 PID 2164 wrote to memory of 1644 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 36 PID 2164 wrote to memory of 1644 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 36 PID 2164 wrote to memory of 1644 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 36 PID 2164 wrote to memory of 1644 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 36 PID 2164 wrote to memory of 1644 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 36 PID 2164 wrote to memory of 1644 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 36 PID 2164 wrote to memory of 1644 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 36 PID 2164 wrote to memory of 2628 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 37 PID 2164 wrote to memory of 2628 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 37 PID 2164 wrote to memory of 2628 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 37 PID 2164 wrote to memory of 2628 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 37 PID 2164 wrote to memory of 2628 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 37 PID 2164 wrote to memory of 2628 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 37 PID 2164 wrote to memory of 2628 2164 6774a06aa7558fce73fa53d9558eb7a3.exe 37 PID 2952 wrote to memory of 1880 2952 cmd.exe 39 PID 2952 wrote to memory of 1880 2952 cmd.exe 39 PID 2952 wrote to memory of 1880 2952 cmd.exe 39 PID 2952 wrote to memory of 1880 2952 cmd.exe 39 PID 2952 wrote to memory of 1880 2952 cmd.exe 39 PID 2952 wrote to memory of 1880 2952 cmd.exe 39 PID 2952 wrote to memory of 1880 2952 cmd.exe 39 PID 2628 wrote to memory of 2764 2628 cmd.exe 40 PID 2628 wrote to memory of 2764 2628 cmd.exe 40 PID 2628 wrote to memory of 2764 2628 cmd.exe 40 PID 2628 wrote to memory of 2764 2628 cmd.exe 40 PID 2628 wrote to memory of 2764 2628 cmd.exe 40 PID 2628 wrote to memory of 2764 2628 cmd.exe 40 PID 2628 wrote to memory of 2764 2628 cmd.exe 40 PID 2960 wrote to memory of 308 2960 WScript.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\6774a06aa7558fce73fa53d9558eb7a3.exe"C:\Users\Admin\AppData\Local\Temp\6774a06aa7558fce73fa53d9558eb7a3.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\mybar\conime.exeC:\Windows\mybar\conime.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724 -
C:\Windows\SysWOW64\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v "google" /d "c:\windows\mybar\conime.exe " /f3⤵
- Adds Run key to start application
PID:300
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\index.vbe" 02⤵
- Drops file in Windows directory
PID:1964 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg3⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Runs .reg file with regedit
PID:2768
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Windows\0\8.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:596
-
-
C:\Windows\SysWOW64\cmd.execmd /c regedit.exe /s C:\Windows\reg.reg2⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\reg.reg3⤵
- Installs/modifies Browser Helper Object
- Runs .reg file with regedit
PID:1880
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\7\searchOld.vbe" 02⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s C:\Windows\search.reg3⤵
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:308
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\iecollection.vbe" 02⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1644 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s C:\Windows\ShowIeLinkIe6.reg3⤵
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:524
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s C:\Windows\ShowIeLinkIe7.reg3⤵
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c regedit.exe /s C:\Windows\WindowsMy.reg2⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\WindowsMy.reg3⤵
- Modifies registry class
- Runs .reg file with regedit
PID:2764
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://dianxin.online.cq.cn/api/tanchuang/url.htm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:537614 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://dianxin.online.cq.cn/api/tanchuangone/url.htm2⤵PID:2328
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\del.bat2⤵
- Deletes itself
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD50bd157d1a9e93eaaf163990efd3c6636
SHA15ffa7272f7e95057646859f248bc114247b4309e
SHA2565703e5eb54bf7bd1a9a46e88b883a0c6f73be3a9445c94c4bbdb55b0982f6162
SHA5126f82a517ca3db260598c6d09372c8a4bc0b3cbfc7fdc3790ddb4d5703cc82beeb443a9996f0f0fb4c5bf633adbf8a24afdfa03b53a643df2b37244098e28af8b
-
Filesize
27KB
MD536219ca941541565e5efbe3e59a59150
SHA1738fbbbcafb06d27890b032c64c38b2e08eab93a
SHA256782010cbacd867d5d34fcc98a429efee6be41b1d4d5bdc63e765c93cc6b442fe
SHA512d474f12239849b8ea0034bf3e272c91309c9bbd7d1b0693d28dae91be4fe2ce573dbc3d4f0e44abef886844396643928755c09d6bfd65aeb0c9f47f30003a49f
-
Filesize
82KB
MD5a3cca02ae84bba169833d00e8c3555d4
SHA127317330e4dfe7c1fffc6efb97296217c8d8325a
SHA256d7c785afa6436e45bb8a95d2bd92aa711a36acb5bc8e843deeff99d74ebd7ed6
SHA512ebc3abb60426099535f2c9cf781310e85575a6a2f017273fec6c3f2ddf31867256f95fb33fcacae40a16c05f4bd08f67440f0a1904c513f8ff5d187b4431c350
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a694ba74622dd7b2e4da9e1ce195381
SHA1a7992f012f7f7f117759e853fe265eebb0d94451
SHA25635a670563f45735250b5c14693d6432306e83eb9a52a7e7b0f3fafd30f8bdc8a
SHA51257cb33a8ea77c3811b694d233ee67a9be6268c273cefb64c88bbe3b003b687223b4734273e5b5d83340137f70b2fe625b75f5b18089491946121604b3786e040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb237b8d5e1ab5b13518018bf4d13d16
SHA1617328169caaf24364b787edcac3ecdafbb349b3
SHA25608b4bb1092d1b07d4af8d869ec7dbf638de5b9f3b8893287479a7e3e01097e2d
SHA5123da0688e3b0ae612419ec5e093fcb95ba810b2a4fa440e77f30408d068b136040e4e431ec528d1078d0a09f21ec15632296dab4f9f82132da857ab8c6dd1e49a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0d3c8d68f3ec9876e0aa20ee5542f97
SHA11bdcd2d730523743fbd2f2b199ca23169027fcf7
SHA256a36b2f8208fbc6b5ae5e66250a686eff09562a62b8eebc88f27f7e861f9e55d1
SHA51205f1ad969900d5e84ce98c3553be0638df0674ed090bcbf9bedcc028b42ae7953551ce9c773da0a59ff85633bd07a40b0ea729a53afe50061053b9e4cdc6a410
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eee155a0ad295b6182098dc63135d87c
SHA127359a7018cc617478df1f1410ba65d1f54161bc
SHA2564be3a365214d45f66317bf0c5fe0fdc437688885d910567b6657172674b9d248
SHA51234960580bd883dd3acc599dc07f0bee317a6b6db5ef25f18ba949e0309921ee6fc50d210b17bf4e8920c2ad0e9b6cd37632839d55971869be1bf5147e6ef06f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4d6b63fc64f8bf5c7231ef929359481
SHA1c92db74e9ea6f8e44773cca6b71573e829d9429f
SHA256373f7b4aaf675c9ad2ba5264c1995c4b61f5f06045aff9e1b477c0d9758bb09b
SHA5125db68b31b8165637899e3487e360705b27fd8b872eb3fb2d07240d90f9ebe624b22ae7fd62c5291cc06d30fff01e50cbcba90889c7c1ff869834e95f0740c85f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a3a272b4e538b5645d5631bdfdb09d1
SHA15dfe227d5bdb5f66f384901a37bdb4154a54bfae
SHA2561d308b4d3e2f0dd308f594dd0da07a000fff4631d7e863c638a8cdcc16070ee3
SHA5124e9e2c3128faa4a06f203427e598e9a2b9773113f70d6e92908bbcd49c4339813a271dccb5295faafddad1a4e00a55f43b5a952b68c179947e3d25b2cf60315a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5254ca3e78683131aa765f58e4ad8b1a1
SHA10b28aaa9b6b7882244ead4175d1fe8078a2df94f
SHA256701e45a22e742c7bf4758057e3d985288eaa2c7a802775df0e7141e7b6695fa6
SHA512a60e5873b2f7cb4c723d2847132dde2cee915c0a1475b9454a2e88cf1a39e422ff84398e8b607eb5667fb6735831cdf8f90e2e3258908155e6b38a3d7e624816
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\errorPageStrings[2]
Filesize2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\httpErrorPagesScripts[1]
Filesize8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
28KB
MD5fbe32b3eb39297d21c8a9693922f2b03
SHA1b261b975d400f6ade195b65c83c9de645f9156db
SHA2561d7ebda8b43d465aea6ad5a291f1f093488a36b5c9aae7a9b3982ae1a105d17d
SHA5125b23bc1c2b52cfd4ea17af92386762d2a7d5b149a30ed9bf48538a5e2274a69183260c92b98ac2b287231fdda30cfa30d7afe9eaa21267c7d5504752b20bffa0
-
Filesize
2KB
MD56e0f1a44a991ba646d30719de7ee2d9b
SHA1a42c11be86419238ba592eb3b79692f0111096b0
SHA2565a4ee98975aeaefc7e784c36f1faf611ac421bad2ff71e461cbdafc8f937b4ba
SHA51237e1a0d8e1087e11ad51f6038bc5f725484a9aceadf6b697457db1259fbb29e6a672af4af92c451d47ee57911845ae4728826b9612d27223431de691ceb1c7bc
-
Filesize
143B
MD54c3fcb0fe03094280e5790b954494d23
SHA1083ea34d4766c0f1d816baa5aae4daf6600fd7ca
SHA2565694d2c8a0db92e0878dae0d1f9dd3dc6079b9375633ad07e65c9e879c37bcd7
SHA512cbe7fd8c0185dc5b91478ed5f609528de34810283a286acc67e48c70cfe32c96be226d0c6543ba6468a1c532786c7135032f636f1b584e8eba20bb8ebe8cd4d0
-
Filesize
7KB
MD54f69fa82c34c91514da21a5933644af8
SHA1e131f57f41ce95b46195d460852718b83517579a
SHA2567cd8b741bfaee5cd14779b69d71b362aac4c928097c6b4af8ce0ce16bde52a46
SHA512276588f960d28023febd87873c7852f401ab6ebfb3d90bf8b21b1998949d8ab00badb42d1a05934587aa6b4ad0ab06a3d649dcdb70f384ca70339049243463c4
-
Filesize
9KB
MD5dbd46bf2e72f6dfbb21295f4e3066d47
SHA1cdd6ca2f6455c1e528c40a520bcdb8669df8f548
SHA25671927f4f034db038385346e34209ad069139f54d73bae34bfaf4f29b7010fc6b
SHA512ad013387a0c7608375b7a3c5fdb27f0d9e79b051d84b1ee9221346499f386d30473b5e2727f6a4e8a8122cf8ac2d473a5ce5e368e62da09441ed48e5c088bd11
-
Filesize
1KB
MD5713e7542ede7975f60b6361e4b234eac
SHA13a11cd2def80f43ac02850cfeac0e54f6ebf7a95
SHA2568c4b40dfd44928643dd5dea8ff3e15eb9d25f020722bd2095d7d37f3a64fac5d
SHA512da0578694cddb363d6f4f6d01f9881bbecc8c775c121aae3470bc6e49575fa2c65244043d7276d6f62390fab2926881a7bcfba5210ae312e374badd2b306dc8c
-
Filesize
185B
MD5f62c5deb08df74f7f3cea25c6b7af137
SHA143adc1ba72c8983fae70f29bdc3ba6ae15b81141
SHA256ff6236d2e884773dfebd61af053776caf3cccf815124343abcab4734bad4b602
SHA512ccf6294eaeedff8a386dad260e6927507a3da0146cb5a3a06a6ab62c85009a09fbc056ae73e0264eaf3542a3bb4be24e8f142a81f0ec4820d9790fbdb614aed5
-
Filesize
1KB
MD59fc297755434ae17309f0a37a5eb9e36
SHA1d1ae58eebcf5564f2e8542091cc4724e6cf2f90d
SHA2564d910952568649b688572a188e9d1dc90933c4a098bccdf615f30655b121ed25
SHA512b5b9e11c43b591a48f0a4799c41b57a69b68da6364cf095e1ff21e4c4333cefb66b5d31d495c1ac70e4f220afddc1b41379c74865b783465b21951406a67f0cb
-
Filesize
64KB
MD5ce08bdb45107f41826d1feb4507a8886
SHA112c3cfc71b6028a187d2b10f179552c14a7bb22f
SHA256701a246d1a6a182b7176a3f8c1c913b131c0fdd351b9610d398cfb88ffa2d1bd
SHA512467727b3f675e8ae73e25e4a0be5b73a79da5c09ff7d1d2b331b8a4cb93fa2c6ce026b00419c1770408415331c777dc2ecbcd9b5ec4a70d6e372342ad0edec88