Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe
Resource
win10v2004-20231215-en
General
-
Target
b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe
-
Size
2.5MB
-
MD5
f3b0179ba1f2f60ea88c4f14c4e7a829
-
SHA1
cada0b63415bfdafac480da21742d673a6f1d359
-
SHA256
b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a
-
SHA512
fd4f6e6eec6e565435c7fd7d6e5f79d7f59cca0e9ef068f370c65b270d5d4fa034b0990ecb8fb4427ee58ff5048b88130c2b80002e7d63a15c0b4aec2d342303
-
SSDEEP
49152:VkJD9VUS2v2/czNA6XgbuzDUyjYFb1nbuZvaMba5A7e0JSkJsGdLtFprqRbFFjfr:y9ESLEzNA6XAycRpuwiPBOGdZGxFFrJh
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 5yN0yH9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 5yN0yH9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 5yN0yH9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 5yN0yH9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 5yN0yH9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 5yN0yH9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" 5yN0yH9.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 5yN0yH9.exe -
Executes dropped EXE 4 IoCs
pid Process 2276 EU6Wr47.exe 2400 fo7Qf38.exe 2772 2OC4417.exe 1872 5yN0yH9.exe -
Loads dropped DLL 9 IoCs
pid Process 2648 b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe 2276 EU6Wr47.exe 2276 EU6Wr47.exe 2400 fo7Qf38.exe 2400 fo7Qf38.exe 2772 2OC4417.exe 2400 fo7Qf38.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 5yN0yH9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 5yN0yH9.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" EU6Wr47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" fo7Qf38.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 5yN0yH9.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe 1872 5yN0yH9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2012 schtasks.exe 2144 schtasks.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60268d02d943da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29638811-AFCC-11EE-914A-EED0D7A1BF98} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001a03df9621d9c57e33d7788df3e075e383eec76ab169e200444a8ce948cf11e0000000000e80000000020000200000003efd53984949ae890d265e3045d9285413339f788d526b379d40f8e2d843933790000000eaea3a15babbf397847bafd40123f13b007c71f4488b7827cc5d3bb6a9ed6ea0ef1b7534dbd670637db82896bedfc4470d3b4471d423256c3d86ecbe2b5c822c0433e010bde2dab12a65a70156437a1a2ec305694b3d190d7c65fa4541d66831520e6a53766dba2cdfb4b30587f8afc5dd2e0a7907207ccb70fc378ecfdbb8c44e96a24ccce31809dcc0cb4f8c0f7536400000001e4b7c8f599613dc8d00e34d4d79ad3d964f36948bf0ce675cf55565a5333aa7998be02f524d34b579c2c855ab334821dac045928035ca35602e5d07a719ac8c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411062067" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29614DC1-AFCC-11EE-914A-EED0D7A1BF98} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006c8d102d1edada4af0befdeb6365a41de0c0065c4c6db7bad77603b95a7bc1c9000000000e80000000020000200000007f39d4195294b2c0c62cd25f4bec34a3135ddd0cc2d6d6931ff92f4f5a4bdf51200000001bdae0195ecaf72a259c5528fc09836e3c69aa9d454a28bc55b4845b04ec70134000000027f949b88e8e94b401b08b24c166a13faae1039dd13cb2b56a5517b1174b6a385a9fc9ed5a86ed17954e99b6836ef598b8f52d27bb91edeb322bc37e2fe59a08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1868 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1872 5yN0yH9.exe Token: SeDebugPrivilege 1868 powershell.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2772 2OC4417.exe 2772 2OC4417.exe 2772 2OC4417.exe 2372 iexplore.exe 2676 iexplore.exe 2684 iexplore.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2772 2OC4417.exe 2772 2OC4417.exe 2772 2OC4417.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 2676 iexplore.exe 2676 iexplore.exe 2684 iexplore.exe 2684 iexplore.exe 1872 5yN0yH9.exe 2452 IEXPLORE.EXE 2452 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2276 2648 b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe 28 PID 2648 wrote to memory of 2276 2648 b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe 28 PID 2648 wrote to memory of 2276 2648 b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe 28 PID 2648 wrote to memory of 2276 2648 b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe 28 PID 2648 wrote to memory of 2276 2648 b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe 28 PID 2648 wrote to memory of 2276 2648 b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe 28 PID 2648 wrote to memory of 2276 2648 b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe 28 PID 2276 wrote to memory of 2400 2276 EU6Wr47.exe 30 PID 2276 wrote to memory of 2400 2276 EU6Wr47.exe 30 PID 2276 wrote to memory of 2400 2276 EU6Wr47.exe 30 PID 2276 wrote to memory of 2400 2276 EU6Wr47.exe 30 PID 2276 wrote to memory of 2400 2276 EU6Wr47.exe 30 PID 2276 wrote to memory of 2400 2276 EU6Wr47.exe 30 PID 2276 wrote to memory of 2400 2276 EU6Wr47.exe 30 PID 2400 wrote to memory of 2772 2400 fo7Qf38.exe 29 PID 2400 wrote to memory of 2772 2400 fo7Qf38.exe 29 PID 2400 wrote to memory of 2772 2400 fo7Qf38.exe 29 PID 2400 wrote to memory of 2772 2400 fo7Qf38.exe 29 PID 2400 wrote to memory of 2772 2400 fo7Qf38.exe 29 PID 2400 wrote to memory of 2772 2400 fo7Qf38.exe 29 PID 2400 wrote to memory of 2772 2400 fo7Qf38.exe 29 PID 2772 wrote to memory of 2684 2772 2OC4417.exe 33 PID 2772 wrote to memory of 2684 2772 2OC4417.exe 33 PID 2772 wrote to memory of 2684 2772 2OC4417.exe 33 PID 2772 wrote to memory of 2684 2772 2OC4417.exe 33 PID 2772 wrote to memory of 2684 2772 2OC4417.exe 33 PID 2772 wrote to memory of 2684 2772 2OC4417.exe 33 PID 2772 wrote to memory of 2684 2772 2OC4417.exe 33 PID 2772 wrote to memory of 2372 2772 2OC4417.exe 31 PID 2772 wrote to memory of 2372 2772 2OC4417.exe 31 PID 2772 wrote to memory of 2372 2772 2OC4417.exe 31 PID 2772 wrote to memory of 2372 2772 2OC4417.exe 31 PID 2772 wrote to memory of 2372 2772 2OC4417.exe 31 PID 2772 wrote to memory of 2372 2772 2OC4417.exe 31 PID 2772 wrote to memory of 2372 2772 2OC4417.exe 31 PID 2772 wrote to memory of 2676 2772 2OC4417.exe 32 PID 2772 wrote to memory of 2676 2772 2OC4417.exe 32 PID 2772 wrote to memory of 2676 2772 2OC4417.exe 32 PID 2772 wrote to memory of 2676 2772 2OC4417.exe 32 PID 2772 wrote to memory of 2676 2772 2OC4417.exe 32 PID 2772 wrote to memory of 2676 2772 2OC4417.exe 32 PID 2772 wrote to memory of 2676 2772 2OC4417.exe 32 PID 2372 wrote to memory of 2452 2372 iexplore.exe 36 PID 2372 wrote to memory of 2452 2372 iexplore.exe 36 PID 2372 wrote to memory of 2452 2372 iexplore.exe 36 PID 2372 wrote to memory of 2452 2372 iexplore.exe 36 PID 2372 wrote to memory of 2452 2372 iexplore.exe 36 PID 2372 wrote to memory of 2452 2372 iexplore.exe 36 PID 2372 wrote to memory of 2452 2372 iexplore.exe 36 PID 2676 wrote to memory of 1060 2676 iexplore.exe 34 PID 2676 wrote to memory of 1060 2676 iexplore.exe 34 PID 2676 wrote to memory of 1060 2676 iexplore.exe 34 PID 2676 wrote to memory of 1060 2676 iexplore.exe 34 PID 2676 wrote to memory of 1060 2676 iexplore.exe 34 PID 2676 wrote to memory of 1060 2676 iexplore.exe 34 PID 2676 wrote to memory of 1060 2676 iexplore.exe 34 PID 2400 wrote to memory of 1872 2400 fo7Qf38.exe 37 PID 2400 wrote to memory of 1872 2400 fo7Qf38.exe 37 PID 2400 wrote to memory of 1872 2400 fo7Qf38.exe 37 PID 2400 wrote to memory of 1872 2400 fo7Qf38.exe 37 PID 2400 wrote to memory of 1872 2400 fo7Qf38.exe 37 PID 2400 wrote to memory of 1872 2400 fo7Qf38.exe 37 PID 2400 wrote to memory of 1872 2400 fo7Qf38.exe 37 PID 2684 wrote to memory of 2832 2684 iexplore.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe"C:\Users\Admin\AppData\Local\Temp\b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EU6Wr47.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EU6Wr47.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fo7Qf38.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fo7Qf38.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5yN0yH9.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5yN0yH9.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1872 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST5⤵PID:852
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST5⤵PID:1292
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:2144
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2OC4417.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2OC4417.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://facebook.com/login2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2452
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:23⤵
- Suspicious use of SetWindowsHookEx
PID:2832
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57980d9ccda3c40de6c9d0e96f69b3a10
SHA1c9a18d0c8cdc3c30a93faa478e8b5fd1600e4b3f
SHA256f024a25aec5a97dd4bb2433ff753a5999e4de166d234419b23c6ee13ec44f778
SHA512ad3c6ba0437f9095125c68608a578acdc08fe6f9520f705a71673dc5a27a662980e290124e6f0c31c065d6e0c95d70064326857f0d3f41392942164a34be7f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e932946aa4bcdd5d65c2b9784b7f1b29
SHA1028ce9afc7c4c1b33869beb6312ef022dd50c04d
SHA256ebd8091d86165ff4b1ba42a3ee0af4266d1844d46a073c1314a536050c273446
SHA512964cc7c7b6ccfebb33d0a70ed8479c24582981770515f21c4e691f38afa1d844d77ca4e60dc9c81e4f60a6a13144b25f559f4035e475014be778d9d524f4289d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6ed5300f1775fea4bcbbc51aeb019cd
SHA1f79fac827bff5c541e078cfc88dd6694ef857a54
SHA2560bdbc81a897bcf3202390da9c41c2de0719b6eea4221aec08a014c43c96dc3f2
SHA512f7853e2b372548ff3e67dfbc6b23d46d3b9cef80619703ba13079a3ed8d36165fec5e559107f46dc3a39954581b63bd60cf31794d3b0673eed40ba4bf049563d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9a03d98165b0cf4b3fb46a39ba69de1
SHA17c49366b0c3c6340036d302c68e38869231078f0
SHA25618d33acd46336814ef48a77f3ea3cfa570e30bcbc8e17236c8ef40c55d4ccad8
SHA512c95d74ba18ef1a2c53c635de51f9ee11b894c243031e9e3c2dfc9316eb43be169fb7f4f3f526bf05ec882b5b926914ab10b9700ec25cb9c10d61f82a90c7ea26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500befa826910c77fdb3cf75ac7f76dd5
SHA146626a6d495d5e5aafe73c7ad6dd44c8f892c3be
SHA256c9949e6f59fcd03bb775d41075d8284483f250343d47ac260d4cdb1f47b3f202
SHA512b449cf80bbca0d4e5ac7d07768083ec372047db4eac8b8a6b7fbbc9fd3239b7c0d5e2fc5a465baf905dd0d429afac94ae901ec3c2a8768a283f64297564c1c1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad63f6416cfa3b9bd2f6b5b6dfd396ba
SHA176498daf3820c6a5f26058a03b2d2622aeaf8101
SHA2563ae8f065db71455229f009e607c4579327797405c8ded0077a6ae5b0da8a8cdc
SHA5126bae14674db34a6cc71a8b105f76db196510eed974c6cfd1bcb97c61d8545e3d4015748ab07c3e07fb48bbff14d4ebee5e34d5480ce3c40c8a9f3af7c8caa414
-
Filesize
641KB
MD56a19f2fbfa7b8b17d0efeb801ecdb233
SHA1a84c70d3c6b49adde66d18ab52366d09f840e7f7
SHA256941aad9b74506d7a5a35d5234dc5febf82bff1ba84379da0b20180ef264ddea7
SHA512c8fc42777b8396eabdb28622f8f3a1897a26d1645ac246231d953ba7158b422fbabf89d244db12f02ba28ac722c43aff6e2ed44a1cdca1bbec5b40d204eaf5d4
-
Filesize
129KB
MD5c01da65814ef655c5531b8dea72ec60f
SHA14be2db0ebec876ab423dc774c29d39ff4910b239
SHA2562d7f707460001f42818aac1cf43b780eee1c8dbe6cae817ee493150df64f6904
SHA5126c3ebf65c7f294397d75053dc75027183e274f0a999b4c35b98bdb18fa0da0b746124d26fec25ad7a1635b95d0057e95873e4296bfd481346742a8887e84da43
-
Filesize
1.3MB
MD504e22e4bb4d40dd433682c084bc484f0
SHA17ced37a92dde45e6dde394f1db7d8aecf2f7a988
SHA256e47e1ae4862e95287a0735c9566f2bbb5dbb828b128518533802bae6ead13507
SHA512618beee4c2ff17beb4081b00db49a3f052e9f453761a52da4867ca89ae6e1dd10647a181553a0cdc406b821f2979a09e2a29965fe99b38551be01c3ff958ed61
-
Filesize
103KB
MD51251b8163afe401faffbfc2924e3e2b1
SHA1b4afbda5fa48643f300b1a753ba709105c2f7ddd
SHA256777176358b068d395bd29324e58be6aeeb52315c9a3801848e2a912a6402a829
SHA5120a86ba5ffa1431e89fd1437b393a719ec04795970c7282082a78c394c3a88c40881fb1e17a5707e7482dd98f5e9b7d9899a875deb18a90288ea1959ac251dfc6