Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 12:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
abeaeb8dd0cd8943eb01e47d308ebf06.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
abeaeb8dd0cd8943eb01e47d308ebf06.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
abeaeb8dd0cd8943eb01e47d308ebf06.exe
-
Size
125KB
-
MD5
abeaeb8dd0cd8943eb01e47d308ebf06
-
SHA1
26f5ade461be02177a07a2a77541a978e1288ade
-
SHA256
e408f2940a747f830680a12bab0a22470c6b315c7acbcb190613b7b58dbda61c
-
SHA512
9f6aaf0113456bee6651907e8216c03e0bc80d882ab40645021a907809c2f06b17c2096c5f6dec9bd991e2ae91c41df7d8b0ce7ef69b41d5fa9e3c045c0e6978
-
SSDEEP
3072:AqBFJLzgOJJPolDa08S8OwsxLZ4LaXUiYPAsobPpKY00X/6u0Nv8:XPdZMl3d8OJLZb9sobMuSv8
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 2136 max2_133daohang4.exe 2524 3795DB80.exe 2516 3795DB80.exe 2820 3795DB80.exe 2164 3795DB80.exe 1924 3795DB80.exe 2432 3795DB80.exe 500 3795DB80.exe -
Loads dropped DLL 51 IoCs
pid Process 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2136 max2_133daohang4.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2136 max2_133daohang4.exe 2136 max2_133daohang4.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2136 max2_133daohang4.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2524 3795DB80.exe 2524 3795DB80.exe 2524 3795DB80.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2516 3795DB80.exe 2516 3795DB80.exe 2516 3795DB80.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2820 3795DB80.exe 2820 3795DB80.exe 2820 3795DB80.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2164 3795DB80.exe 2164 3795DB80.exe 2164 3795DB80.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 1924 3795DB80.exe 1924 3795DB80.exe 1924 3795DB80.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2432 3795DB80.exe 2432 3795DB80.exe 2432 3795DB80.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 500 3795DB80.exe 500 3795DB80.exe 500 3795DB80.exe 2136 max2_133daohang4.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\IEXPLOR.EXE abeaeb8dd0cd8943eb01e47d308ebf06.exe File opened for modification C:\Program Files (x86)\WinRAR\WinRAR.knl abeaeb8dd0cd8943eb01e47d308ebf06.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0032000000013a46-8.dat nsis_installer_1 behavioral1/files/0x0032000000013a46-8.dat nsis_installer_2 -
Modifies File Icons 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Shell Icons abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons abeaeb8dd0cd8943eb01e47d308ebf06.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Shell Icons\29 = "C:\\Windows\\system32\\shell32.dll,50" abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\29 = "C:\\Windows\\system32\\shell32.dll,50" abeaeb8dd0cd8943eb01e47d308ebf06.exe -
Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open2 abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open2\Command abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\TypeLib abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open\Command abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\DropHandler\ = "{60254CA5-953B-11CF-8C96-00AA00B8708C}" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ScriptEngine\ = "JScript.Encode" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Print\ = "´òÓ¡(&P)" abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.knl\ = "wfile" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open2\ = "ÔÚÃüÁîÌáʾ·ûÖдò¿ª(&W)" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\ShellFolder abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ScriptEngine abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Edit\Command abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open2\Command\ = "%SystemRoot%\\SysWow64\\CScript.exe \"%1\" %*" abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\PropertySheetHandlers\WSHProps\ = "{60254CA5-953B-11CF-8C96-00AA00B8708C}" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\Shell\Internet Explorer abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Print abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Edit abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open\Command\ = "%SystemRoot%\\SysWow64\\WScript.exe \"%1\" %*" abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Print\Command\ = "%SystemRoot%\\SysWow64\\Notepad.exe /p %1" abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\InfoTip = "Intrnet Explorrer" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\Shell abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\TypeLib\ = "{124BE3CB-0831-4324-B94F-F8424D2C3638}" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\DefaultIcon abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\Shell\Internet Explorer\Command abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\Shell\Internet Explorer\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.pp2345.com" abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\ShellFolder\Attributes = "0" abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open\ = "´ò¿ª(&O)" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\PropertySheetHandlers abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\WScript.exe,3" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\DropHandler abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\ = "Intrnet Explorrer" abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Edit\ = "±à¼\u00ad(&E)" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Print\Command abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Edit\Command\ = "%SystemRoot%\\SysWow64\\Notepad.exe %1" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\FriendlyTypeName = "@%SystemRoot%\\System32\\wshext.dll,-4805" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\PropertySheetHandlers\WSHProps abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638} abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{124BE3CB-0831-4324-B94F-F8424D2C3638}\DefaultIcon\ = "C:\\Windows\\SysWow64\\SHELL32.DLL,220" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.knl abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx abeaeb8dd0cd8943eb01e47d308ebf06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ = "JScript ÒѱàÂëµÄ Script Îļþ" abeaeb8dd0cd8943eb01e47d308ebf06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wFile\DefaultIcon abeaeb8dd0cd8943eb01e47d308ebf06.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2364 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 28 PID 2100 wrote to memory of 2364 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 28 PID 2100 wrote to memory of 2364 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 28 PID 2100 wrote to memory of 2364 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 28 PID 2100 wrote to memory of 2364 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 28 PID 2100 wrote to memory of 2364 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 28 PID 2100 wrote to memory of 2364 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 28 PID 2100 wrote to memory of 2136 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 29 PID 2100 wrote to memory of 2136 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 29 PID 2100 wrote to memory of 2136 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 29 PID 2100 wrote to memory of 2136 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 29 PID 2100 wrote to memory of 2136 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 29 PID 2100 wrote to memory of 2136 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 29 PID 2100 wrote to memory of 2136 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 29 PID 2100 wrote to memory of 2524 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 31 PID 2100 wrote to memory of 2524 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 31 PID 2100 wrote to memory of 2524 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 31 PID 2100 wrote to memory of 2524 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 31 PID 2100 wrote to memory of 2524 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 31 PID 2100 wrote to memory of 2524 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 31 PID 2100 wrote to memory of 2524 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 31 PID 2100 wrote to memory of 2516 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 33 PID 2100 wrote to memory of 2516 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 33 PID 2100 wrote to memory of 2516 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 33 PID 2100 wrote to memory of 2516 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 33 PID 2100 wrote to memory of 2516 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 33 PID 2100 wrote to memory of 2516 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 33 PID 2100 wrote to memory of 2516 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 33 PID 2100 wrote to memory of 2820 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 35 PID 2100 wrote to memory of 2820 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 35 PID 2100 wrote to memory of 2820 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 35 PID 2100 wrote to memory of 2820 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 35 PID 2100 wrote to memory of 2820 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 35 PID 2100 wrote to memory of 2820 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 35 PID 2100 wrote to memory of 2820 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 35 PID 2100 wrote to memory of 2164 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 37 PID 2100 wrote to memory of 2164 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 37 PID 2100 wrote to memory of 2164 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 37 PID 2100 wrote to memory of 2164 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 37 PID 2100 wrote to memory of 2164 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 37 PID 2100 wrote to memory of 2164 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 37 PID 2100 wrote to memory of 2164 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 37 PID 2100 wrote to memory of 1924 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 39 PID 2100 wrote to memory of 1924 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 39 PID 2100 wrote to memory of 1924 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 39 PID 2100 wrote to memory of 1924 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 39 PID 2100 wrote to memory of 1924 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 39 PID 2100 wrote to memory of 1924 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 39 PID 2100 wrote to memory of 1924 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 39 PID 2100 wrote to memory of 2432 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 41 PID 2100 wrote to memory of 2432 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 41 PID 2100 wrote to memory of 2432 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 41 PID 2100 wrote to memory of 2432 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 41 PID 2100 wrote to memory of 2432 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 41 PID 2100 wrote to memory of 2432 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 41 PID 2100 wrote to memory of 2432 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 41 PID 2100 wrote to memory of 500 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 43 PID 2100 wrote to memory of 500 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 43 PID 2100 wrote to memory of 500 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 43 PID 2100 wrote to memory of 500 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 43 PID 2100 wrote to memory of 500 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 43 PID 2100 wrote to memory of 500 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 43 PID 2100 wrote to memory of 500 2100 abeaeb8dd0cd8943eb01e47d308ebf06.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\abeaeb8dd0cd8943eb01e47d308ebf06.exe"C:\Users\Admin\AppData\Local\Temp\abeaeb8dd0cd8943eb01e47d308ebf06.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies File Icons
- Modifies Shortcut Icons
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\WScript.exe"WScript.exe" "C:\Program Files (x86)\WinRAR\WinRAR.knl"2⤵PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\max2_133daohang4.exe"C:\Users\Admin\AppData\Local\Temp\max2_133daohang4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\3795DB80.exeC:\Users\Admin\AppData\Local\Temp\3795DB80.exe "C:\Users\Public\Desktop\Internet Explerer" /P "Admin":F /y2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\3795DB80.exeC:\Users\Admin\AppData\Local\Temp\3795DB80.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Æô¶¯ Internet Explerer ä¯ÀÀÆ÷.lnk" /P "Admin":F /y2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516
-
-
C:\Users\Admin\AppData\Local\Temp\3795DB80.exeC:\Users\Admin\AppData\Local\Temp\3795DB80.exe "C:\Users\Public\Desktop" /P "Admin":R /y2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\3795DB80.exeC:\Users\Admin\AppData\Local\Temp\3795DB80.exe "C:\Users\Public\Desktop" /E /G "Admin":W /y2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\3795DB80.exeC:\Users\Admin\AppData\Local\Temp\3795DB80.exe "C:\Users\Public\Desktop" /E /G "Admin":C /y2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924
-
-
C:\Users\Admin\AppData\Local\Temp\3795DB80.exeC:\Users\Admin\AppData\Local\Temp\3795DB80.exe "C:\Users\Public\Desktop\Internet Explerer.lnk" /d "Admin" /y2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432
-
-
C:\Users\Admin\AppData\Local\Temp\3795DB80.exeC:\Users\Admin\AppData\Local\Temp\3795DB80.exe "C:\Users\Public\Desktop\Internet Explerer.lnk" /E /G "Admin":R /y2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54311f43d0c295b69a90343ca95614dae
SHA1fa8e8a368a988d44511c6a3b3432a239a154ecce
SHA2569d5c0d496efcc43c24011f78910a992c075823a338c2bfe0bc6225961248275f
SHA512626e31668f5eba951b47c55da8052f6406698a858b25dbdd9f1bd1ec8867aa614ad7097e20b4b51f4e05ccb2f49bd4e71a2f242dcf78c43cebd89343acf83373
-
Filesize
44KB
MD578fd41a1e1d2cf1c7657cf80bdde1164
SHA1acb97223f909ab20dd0b0e655a8869e78b056d2b
SHA25601259b3cd50d39ca21b03af4e22a7bca2b91cf11ab4ce78661c646f08f6bce00
SHA512317e4013bdd70cd50d28961581fe7b774116ea83083718c9db921a86adab5c8d2d3a5cdedd9d172ba65b7a3c7b0699aa8546061b995d3f62e10062f568b78077
-
Filesize
65KB
MD5b904cf041cacaae74655cf009acfed2e
SHA1028ef889562a55bc98119fe2c186efb35f556bd1
SHA25672f4498744d1c856eb35028fc0fa59bf0a78b0fa833c49ead54115f08c2f3846
SHA5124ebf41f49fdcb1b70c6b88351c85dff98eb2f75787e36b8741e922363ec8134399450351c431cefed42d1757163eb6196275d2c6509a9c4826bcc4961d726d4c
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
20KB
MD58d8fdad7e153d6b82913f6fdc407d12c
SHA1aabbeed33cd5221e4cb22aab6e48310df94facfd
SHA256e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b
SHA51242bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2
-
Filesize
8KB
MD5a7d710e78711d5ab90e4792763241754
SHA1f31cecd926c5d497aba163a17b75975ec34beb13
SHA2569b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
SHA512f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
-
Filesize
6KB
MD5e54eb27fb5048964e8d1ec7a1f72334b
SHA12b76d7aedafd724de96532b00fbc6c7c370e4609
SHA256ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824
SHA512c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4
-
Filesize
21KB
MD533322da8b36ea8b67448ec34c827a319
SHA145cae4b64ecc9bb5d3f1e01faaa14e067e74828d
SHA256fcc886a8ef7575e292ef6210902581273e33047da2f3f6e0092b7887a212c2f0
SHA512e97a4b427e89832c6555ac64044b5b3745164482afd3ff7c4b17005c99f245cc7c7e97653abad345810caca3f472c43f51036157f32926ea81306c939e9e1c3c