Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15/01/2024, 05:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
toolspub1.exe
Resource
win7-20231215-en
windows7-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
toolspub1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
29 signatures
150 seconds
General
-
Target
toolspub1.exe
-
Size
204KB
-
MD5
1312fc2e043e2347c3de8a9a6907c430
-
SHA1
075a04bc32a70aeedb23ee83842dd32fe691ba58
-
SHA256
4b3f4607405154b8182848324699427778605dd52afabaff7a0fd542a4bc9212
-
SHA512
108be06b849ded957240b52b006961f4bb01a9684ac0f2a81d70008f9b3a6cf1c2ee657cfe5ea6f566772735dabbc1c505342f37df6985296ddcebf3e917694f
-
SSDEEP
3072:EkI0nM3Jq/AmlEkJiAj1K/2stqLiP+k9IYBn7Q97fsRLx8yM+cmk:EkICXlETZ2kx7QoxJcL
Malware Config
Extracted
Family
smokeloader
Botnet
pub1
Extracted
Family
smokeloader
Version
2020
C2
http://host-file-host6.com/
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile u1e1oyaq9173u9_1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" u1e1oyaq9173u9_1.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile u1e1oyaq9173u9_1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" u1e1oyaq9173u9_1.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath regedit.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Disables taskbar notifications via registry modification
-
Disables use of System Restore points 1 TTPs
-
Sets file execution options in registry 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrtstub.exe\Debugger = "jlucur.exe" u1e1oyaq9173u9_1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrtstub.exe\Debugger = "nqavzyyvumq.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\u1e1oyaq9173u9.exe\DisableExceptionChainValidation A583.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\Debugger = "rgiqyejasci.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgr108.exe u1e1oyaq9173u9_1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe\Debugger = "vsyscln.exe" u1e1oyaq9173u9_1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "nms.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe u1e1oyaq9173u9_1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "xmyxhy.exe" u1e1oyaq9173u9_1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrtstub.exe u1e1oyaq9173u9_1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\Debugger = "nsroyv.exe" u1e1oyaq9173u9_1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "ivrxuhbittd.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\u1e1oyaq9173u9.exe A583.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrtstub.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe u1e1oyaq9173u9_1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgr108.exe\Debugger = "jkeqmyok.exe" u1e1oyaq9173u9_1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe u1e1oyaq9173u9_1.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath regedit.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Deletes itself 1 IoCs
pid Process 1248 Explorer.EXE -
Executes dropped EXE 3 IoCs
pid Process 2372 A583.exe 2928 B397.exe 1204 u1e1oyaq9173u9_1.exe -
Loads dropped DLL 1 IoCs
pid Process 2580 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\u1e1oyaq9173u9.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\u1e1oyaq9173u9.exe\"" explorer.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\AntiVirService u1e1oyaq9173u9_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus u1e1oyaq9173u9_1.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA A583.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA u1e1oyaq9173u9_1.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\ProgramData\Java Updater\desktop.ini explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 2372 A583.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 1204 u1e1oyaq9173u9_1.exe -
NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x0011000000016cf2-55.dat nsis_installer_2 behavioral1/files/0x0011000000016cf2-54.dat nsis_installer_2 behavioral1/files/0x0011000000016cf2-53.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u1e1oyaq9173u9_1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u1e1oyaq9173u9_1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 A583.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString A583.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1704 schtasks.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\u1e1oyaq9173u9_1.exe:1BB7FB68 explorer.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\u1e1oyaq9173u9_1.exe:1BB7FB68 explorer.exe -
Runs regedit.exe 1 IoCs
pid Process 844 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2804 toolspub1.exe 2804 toolspub1.exe 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 2804 toolspub1.exe 2372 A583.exe 2372 A583.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 1204 u1e1oyaq9173u9_1.exe 1204 u1e1oyaq9173u9_1.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeDebugPrivilege 2372 A583.exe Token: SeRestorePrivilege 2372 A583.exe Token: SeBackupPrivilege 2372 A583.exe Token: SeLoadDriverPrivilege 2372 A583.exe Token: SeCreatePagefilePrivilege 2372 A583.exe Token: SeShutdownPrivilege 2372 A583.exe Token: SeTakeOwnershipPrivilege 2372 A583.exe Token: SeChangeNotifyPrivilege 2372 A583.exe Token: SeCreateTokenPrivilege 2372 A583.exe Token: SeMachineAccountPrivilege 2372 A583.exe Token: SeSecurityPrivilege 2372 A583.exe Token: SeAssignPrimaryTokenPrivilege 2372 A583.exe Token: SeCreateGlobalPrivilege 2372 A583.exe Token: 33 2372 A583.exe Token: SeDebugPrivilege 2580 explorer.exe Token: SeRestorePrivilege 2580 explorer.exe Token: SeBackupPrivilege 2580 explorer.exe Token: SeLoadDriverPrivilege 2580 explorer.exe Token: SeCreatePagefilePrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeTakeOwnershipPrivilege 2580 explorer.exe Token: SeChangeNotifyPrivilege 2580 explorer.exe Token: SeCreateTokenPrivilege 2580 explorer.exe Token: SeMachineAccountPrivilege 2580 explorer.exe Token: SeSecurityPrivilege 2580 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2580 explorer.exe Token: SeCreateGlobalPrivilege 2580 explorer.exe Token: 33 2580 explorer.exe Token: SeDebugPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeRestorePrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeBackupPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeLoadDriverPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeCreatePagefilePrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeShutdownPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeTakeOwnershipPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeChangeNotifyPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeCreateTokenPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeMachineAccountPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeSecurityPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeAssignPrimaryTokenPrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeCreateGlobalPrivilege 1204 u1e1oyaq9173u9_1.exe Token: 33 1204 u1e1oyaq9173u9_1.exe Token: SeCreatePagefilePrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeCreatePagefilePrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeCreatePagefilePrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeCreatePagefilePrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeCreatePagefilePrivilege 1204 u1e1oyaq9173u9_1.exe Token: SeDebugPrivilege 844 regedit.exe Token: SeRestorePrivilege 844 regedit.exe Token: SeBackupPrivilege 844 regedit.exe Token: SeLoadDriverPrivilege 844 regedit.exe Token: SeCreatePagefilePrivilege 844 regedit.exe Token: SeShutdownPrivilege 844 regedit.exe Token: SeTakeOwnershipPrivilege 844 regedit.exe Token: SeChangeNotifyPrivilege 844 regedit.exe Token: SeCreateTokenPrivilege 844 regedit.exe Token: SeMachineAccountPrivilege 844 regedit.exe Token: SeSecurityPrivilege 844 regedit.exe Token: SeAssignPrimaryTokenPrivilege 844 regedit.exe Token: SeCreateGlobalPrivilege 844 regedit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1248 wrote to memory of 2372 1248 Explorer.EXE 28 PID 1248 wrote to memory of 2372 1248 Explorer.EXE 28 PID 1248 wrote to memory of 2372 1248 Explorer.EXE 28 PID 1248 wrote to memory of 2372 1248 Explorer.EXE 28 PID 2372 wrote to memory of 2580 2372 A583.exe 29 PID 2372 wrote to memory of 2580 2372 A583.exe 29 PID 2372 wrote to memory of 2580 2372 A583.exe 29 PID 2372 wrote to memory of 2580 2372 A583.exe 29 PID 2372 wrote to memory of 2580 2372 A583.exe 29 PID 2372 wrote to memory of 2580 2372 A583.exe 29 PID 2372 wrote to memory of 2580 2372 A583.exe 29 PID 1248 wrote to memory of 2928 1248 Explorer.EXE 30 PID 1248 wrote to memory of 2928 1248 Explorer.EXE 30 PID 1248 wrote to memory of 2928 1248 Explorer.EXE 30 PID 1248 wrote to memory of 2928 1248 Explorer.EXE 30 PID 2580 wrote to memory of 1188 2580 explorer.exe 19 PID 2580 wrote to memory of 1188 2580 explorer.exe 19 PID 2580 wrote to memory of 1188 2580 explorer.exe 19 PID 2580 wrote to memory of 1188 2580 explorer.exe 19 PID 2580 wrote to memory of 1188 2580 explorer.exe 19 PID 2580 wrote to memory of 1188 2580 explorer.exe 19 PID 2580 wrote to memory of 1248 2580 explorer.exe 21 PID 2580 wrote to memory of 1248 2580 explorer.exe 21 PID 2580 wrote to memory of 1248 2580 explorer.exe 21 PID 2580 wrote to memory of 1248 2580 explorer.exe 21 PID 2580 wrote to memory of 1248 2580 explorer.exe 21 PID 2580 wrote to memory of 1248 2580 explorer.exe 21 PID 2580 wrote to memory of 2812 2580 explorer.exe 33 PID 2580 wrote to memory of 2812 2580 explorer.exe 33 PID 2580 wrote to memory of 2812 2580 explorer.exe 33 PID 2580 wrote to memory of 2812 2580 explorer.exe 33 PID 2580 wrote to memory of 2812 2580 explorer.exe 33 PID 2580 wrote to memory of 2812 2580 explorer.exe 33 PID 2580 wrote to memory of 1204 2580 explorer.exe 34 PID 2580 wrote to memory of 1204 2580 explorer.exe 34 PID 2580 wrote to memory of 1204 2580 explorer.exe 34 PID 2580 wrote to memory of 1204 2580 explorer.exe 34 PID 2580 wrote to memory of 1204 2580 explorer.exe 34 PID 2580 wrote to memory of 1204 2580 explorer.exe 34 PID 2580 wrote to memory of 1204 2580 explorer.exe 34 PID 1204 wrote to memory of 844 1204 u1e1oyaq9173u9_1.exe 35 PID 1204 wrote to memory of 844 1204 u1e1oyaq9173u9_1.exe 35 PID 1204 wrote to memory of 844 1204 u1e1oyaq9173u9_1.exe 35 PID 1204 wrote to memory of 844 1204 u1e1oyaq9173u9_1.exe 35 PID 1204 wrote to memory of 844 1204 u1e1oyaq9173u9_1.exe 35 PID 1204 wrote to memory of 844 1204 u1e1oyaq9173u9_1.exe 35 PID 1204 wrote to memory of 844 1204 u1e1oyaq9173u9_1.exe 35 PID 1204 wrote to memory of 1704 1204 u1e1oyaq9173u9_1.exe 36 PID 1204 wrote to memory of 1704 1204 u1e1oyaq9173u9_1.exe 36 PID 1204 wrote to memory of 1704 1204 u1e1oyaq9173u9_1.exe 36 PID 1204 wrote to memory of 1704 1204 u1e1oyaq9173u9_1.exe 36 PID 1204 wrote to memory of 1704 1204 u1e1oyaq9173u9_1.exe 36 PID 1204 wrote to memory of 1704 1204 u1e1oyaq9173u9_1.exe 36 PID 1204 wrote to memory of 1704 1204 u1e1oyaq9173u9_1.exe 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1188
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\A583.exeC:\Users\Admin\AppData\Local\Temp\A583.exe2⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\u1e1oyaq9173u9_1.exe/suac4⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\SysWOW64\regedit.exe"5⤵
- Modifies security service
- Sets file execution options in registry
- Sets service image path in registry
- Runs regedit.exe
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\U1E1OY~1.EXE" /RL HIGHEST5⤵
- Creates scheduled task(s)
PID:1704
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B397.exeC:\Users\Admin\AppData\Local\Temp\B397.exe2⤵
- Executes dropped EXE
PID:2928
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2812
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD580c413180b6bd0dd664adc4e0665b494
SHA1e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
SHA2566d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
SHA512347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
-
Filesize
2.3MB
MD52645da7f476c9eff393ffa2f3b568b8b
SHA14c2b33adf41d36f43413dc948eac4c0c5e0d8cbd
SHA256175203f0622572ecd61a3e56db9d0978e8f1292ee7205880fc45107a9f78ea02
SHA5127bed1f5719f1abd246ea93ec68d4a87959cd75b40f1e44a53bf80effd03ea341859d2c052795fb2cda7c738ada3b74243c0789d2940e2a16d4ce6a53189f40e4
-
Filesize
2.2MB
MD5ac56b542f538da252060c1dc7aac29a3
SHA1e56e83282a9cdb9796b289c4fd4029e969f1cc02
SHA2566257c1eb3a3a03e04731d1d9b46cedac0e39baac32eb2f8bd6293f7d127eb2ff
SHA51219b40d601f41e7cd80b4e44edb0c967610e40900135be09838ee4f5537dbc8cadf74c573cf031c8fcd55a3c51952ed1a3da992eb278c82e7fb37b57fde33ef92
-
Filesize
1.9MB
MD5662ce261375b769a3e2f445ab7c6489a
SHA18c3387da8b669c7071d04ab9523d90e99ee92519
SHA2562611322f340a0315604246faf3669af2c80f6f0693ea4cb6e3f7d1a1cf468821
SHA512f050e1ea6cafd400f841103600ca15725b7eeaaa383cd6a9904e164893d1f02e73ca6f4e4596ca61b667bc277b7c009f8f79ba5fbd8d09dfeafbc9ce98f3ea58
-
Filesize
204KB
MD51312fc2e043e2347c3de8a9a6907c430
SHA1075a04bc32a70aeedb23ee83842dd32fe691ba58
SHA2564b3f4607405154b8182848324699427778605dd52afabaff7a0fd542a4bc9212
SHA512108be06b849ded957240b52b006961f4bb01a9684ac0f2a81d70008f9b3a6cf1c2ee657cfe5ea6f566772735dabbc1c505342f37df6985296ddcebf3e917694f