Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe
Resource
win7-20240419-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe
-
Size
5.5MB
-
MD5
4d40c8a9062a9c898b75b032783ce470
-
SHA1
bdb03f2940bb74143248dc6ab5c23e470c3d95e0
-
SHA256
53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b
-
SHA512
dbf358549c0e9a6242ce2d9889f72e03e0256da44e9fa83d2af9edbe2658c033814c8efa19bc62d4c91afe21607c4991527c1d023ff6a6059c7d6b9ab4b916ce
-
SSDEEP
98304:oseHlHdc5b9dXLVi2xIb7S1fw7pXyZ7oz0R5uz0rbJagkW7kOLIx1qxz8hjFrZBr:Bem17h10XvwPhagz7q2wNPQ00M
Score
8/10
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Windows Defender\MSASCui.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Windows Journal\PDIALOG.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPDMC.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnetwk.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javaws.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\java.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Windows Journal\Journal.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\pack200.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\DVD Maker\DVDMaker.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javacpl.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\orbd.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Windows Defender\MpCmdRun.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\ielowutil.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ktab.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmpshare.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\servertool.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files\Microsoft Games\Chess\Chess.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\HelpPane.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\hh.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\twunk_16.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\twunk_32.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\winhlp32.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\bfsvc.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\explorer.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\fveupdate.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\notepad.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\splwow64.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe File opened for modification \??\c:\Windows\write.exe 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe " cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1432 wrote to memory of 1484 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 28 PID 1432 wrote to memory of 1484 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 28 PID 1432 wrote to memory of 1484 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 28 PID 1432 wrote to memory of 1484 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 28 PID 1432 wrote to memory of 620 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 30 PID 1432 wrote to memory of 620 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 30 PID 1432 wrote to memory of 620 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 30 PID 1432 wrote to memory of 620 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 30 PID 1432 wrote to memory of 2336 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 31 PID 1432 wrote to memory of 2336 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 31 PID 1432 wrote to memory of 2336 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 31 PID 1432 wrote to memory of 2336 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 31 PID 1432 wrote to memory of 1504 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 33 PID 1432 wrote to memory of 1504 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 33 PID 1432 wrote to memory of 1504 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 33 PID 1432 wrote to memory of 1504 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 33 PID 1432 wrote to memory of 1244 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 35 PID 1432 wrote to memory of 1244 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 35 PID 1432 wrote to memory of 1244 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 35 PID 1432 wrote to memory of 1244 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 35 PID 1432 wrote to memory of 1516 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 38 PID 1432 wrote to memory of 1516 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 38 PID 1432 wrote to memory of 1516 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 38 PID 1432 wrote to memory of 1516 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 38 PID 1432 wrote to memory of 1088 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 39 PID 1432 wrote to memory of 1088 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 39 PID 1432 wrote to memory of 1088 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 39 PID 1432 wrote to memory of 1088 1432 53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe 39 PID 620 wrote to memory of 904 620 cmd.exe 42 PID 620 wrote to memory of 904 620 cmd.exe 42 PID 620 wrote to memory of 904 620 cmd.exe 42 PID 620 wrote to memory of 904 620 cmd.exe 42 PID 620 wrote to memory of 936 620 cmd.exe 43 PID 620 wrote to memory of 936 620 cmd.exe 43 PID 620 wrote to memory of 936 620 cmd.exe 43 PID 620 wrote to memory of 936 620 cmd.exe 43 PID 620 wrote to memory of 2080 620 cmd.exe 44 PID 620 wrote to memory of 2080 620 cmd.exe 44 PID 620 wrote to memory of 2080 620 cmd.exe 44 PID 620 wrote to memory of 2080 620 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe"C:\Users\Admin\AppData\Local\Temp\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1484
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:904
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:936
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:2080
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:2336
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1504
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe2⤵
- Modifies registry class
PID:1244
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe2⤵
- Modifies registry class
PID:1516
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\53718543d44ab893cb34ddd54af305beadcabf1d3e96b3fb143c4dc059d8e08b.exe2⤵
- Modifies registry class
PID:1088
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
5.5MB
MD5c0f4c07d4e29b3b2b8469339a3dd6a51
SHA140d81d45ae22a0154535b131ab4ecd7836a1ffc6
SHA2562c1db4188f5cce7619e172924dc1a59a0154a0ab2a8ac59e62e3cbf0b5cb3e44
SHA512d38224b85abec60d6bc532cc6028254d78ebcb79852d424138e998923b24cb56dc6b08d78c81510d7aca4680986a03b4cb793e61d99b26ac86a7772ad3def8e4