Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
256s -
max time network
209s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 23:25
Static task
static1
Behavioral task
behavioral1
Sample
06de56df51e4ec81e24d0c4b63b74852.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
06de56df51e4ec81e24d0c4b63b74852.exe
Resource
win10v2004-20231215-en
General
-
Target
06de56df51e4ec81e24d0c4b63b74852.exe
-
Size
37KB
-
MD5
06de56df51e4ec81e24d0c4b63b74852
-
SHA1
c562597176fa1285d932cf7c8fcc37d8ba136fa2
-
SHA256
1fcd845120301e21ed4eadd709ab1a77f6d7edcc9e42e77dd88dcaa218736c29
-
SHA512
b43164fc0540a109c6ccd211ad0797f5010ea78b005464568ac33a4629f098e8c5092cea47618525eee78b4b86cd0d2633a5cb4f72173ade2bb79f7dccff9963
-
SSDEEP
768:zsRxSxR9E+UpZPhwytb0s+JKO+jBTXQl1FE+ONmez7A+cn2TTFfNIt:zsRxyRvUbZwyEJKO+tbaFE337A52TJGt
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\disdn\Flower.exe 06de56df51e4ec81e24d0c4b63b74852.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cross.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UFO.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TNT.Exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systom.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShuiNiu.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TxoMoU.Exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guangd.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systom.exe 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cross.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp 06de56df51e4ec81e24d0c4b63b74852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "C:\\Windows\\system32\\Flower.exe" 06de56df51e4ec81e24d0c4b63b74852.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe 06de56df51e4ec81e24d0c4b63b74852.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\m: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\x: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\e: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\h: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\r: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\v: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\j: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\k: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\t: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\u: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\z: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\o: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\p: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\n: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\q: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\s: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\w: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\y: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\g: 06de56df51e4ec81e24d0c4b63b74852.exe File opened (read-only) \??\l: 06de56df51e4ec81e24d0c4b63b74852.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\c:\autorun.inf 06de56df51e4ec81e24d0c4b63b74852.exe File opened for modification \??\c:\autorun.inf 06de56df51e4ec81e24d0c4b63b74852.exe File created \??\f:\autorun.inf 06de56df51e4ec81e24d0c4b63b74852.exe File opened for modification \??\f:\autorun.inf 06de56df51e4ec81e24d0c4b63b74852.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\a.jpg 06de56df51e4ec81e24d0c4b63b74852.exe File created C:\Windows\SysWOW64\Flower.dll 06de56df51e4ec81e24d0c4b63b74852.exe File opened for modification C:\Windows\SysWOW64\Flower.dll 06de56df51e4ec81e24d0c4b63b74852.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF2C8EB1-A72A-11EE-8CED-6A1079A24C90} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3060 06de56df51e4ec81e24d0c4b63b74852.exe 3060 06de56df51e4ec81e24d0c4b63b74852.exe 3060 06de56df51e4ec81e24d0c4b63b74852.exe 3060 06de56df51e4ec81e24d0c4b63b74852.exe 3060 06de56df51e4ec81e24d0c4b63b74852.exe 3060 06de56df51e4ec81e24d0c4b63b74852.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3060 06de56df51e4ec81e24d0c4b63b74852.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2376 3060 06de56df51e4ec81e24d0c4b63b74852.exe 27 PID 3060 wrote to memory of 2376 3060 06de56df51e4ec81e24d0c4b63b74852.exe 27 PID 3060 wrote to memory of 2376 3060 06de56df51e4ec81e24d0c4b63b74852.exe 27 PID 3060 wrote to memory of 2376 3060 06de56df51e4ec81e24d0c4b63b74852.exe 27 PID 2376 wrote to memory of 2548 2376 IEXPLORE.EXE 29 PID 2376 wrote to memory of 2548 2376 IEXPLORE.EXE 29 PID 2376 wrote to memory of 2548 2376 IEXPLORE.EXE 29 PID 2376 wrote to memory of 2548 2376 IEXPLORE.EXE 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\06de56df51e4ec81e24d0c4b63b74852.exe"C:\Users\Admin\AppData\Local\Temp\06de56df51e4ec81e24d0c4b63b74852.exe"1⤵
- Drops file in Drivers directory
- Sets file execution options in registry
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files\Internet Explorer\IEXPLORE.EXEOpen http://www.netooo.com/down/read.asp2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD508fb4e463053c85809088c0589cc5a4d
SHA1a41036f4f4ca83e29d87124c23fc4ae40b4f96ee
SHA25621ab65c71ed6557710fb56e17eb4bc315ba452f30f6ca3cd9a37de249ea01376
SHA5125c392ddd8db0690395c01c87971affc16fdd9576b95c19826bd6cdb72c936848fb72f3985de5af849c52c928cf80fcffbc555c70b16c73a6ac2302cf81b5a99d
-
Filesize
37KB
MD506de56df51e4ec81e24d0c4b63b74852
SHA1c562597176fa1285d932cf7c8fcc37d8ba136fa2
SHA2561fcd845120301e21ed4eadd709ab1a77f6d7edcc9e42e77dd88dcaa218736c29
SHA512b43164fc0540a109c6ccd211ad0797f5010ea78b005464568ac33a4629f098e8c5092cea47618525eee78b4b86cd0d2633a5cb4f72173ade2bb79f7dccff9963