Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 20:37
Behavioral task
behavioral1
Sample
31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe
Resource
win10v2004-20240508-en
General
-
Target
31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe
-
Size
143KB
-
MD5
c20f60dede72ffcca33f9b097ce0c84b
-
SHA1
c6c2eb78172dd416dcebe2e47f92220d800b8fe4
-
SHA256
31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f
-
SHA512
409e8002db817ddbe5593650d0764be93e1fa719145340f136bff84f05f90b24858d08a382d4f99bf5abd920d9e49b450827584289775c2156af46ed0eafc2b2
-
SSDEEP
3072:M1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgO5v1i/NU82OMYcYYamv5b:6i/NjO5YBgegD0PHzSwi/N+O7
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4548-0-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/files/0x00080000000235fc-10.dat UPX behavioral2/files/0x00070000000235fd-11.dat UPX behavioral2/memory/4548-17-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5} 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe" 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe -
resource yara_rule behavioral2/memory/4548-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x00080000000235fc-10.dat upx behavioral2/files/0x00070000000235fd-11.dat upx behavioral2/memory/4548-17-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\qx.bat 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe File created C:\WINDOWS\SysWOW64\ie.bat 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\WINDOWS\windows.exe attrib.exe File created C:\WINDOWS\windows.exe 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe File opened for modification C:\WINDOWS\windows.exe 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b2e58ab8bf361247b7301f68e304ddb200000000020000000000106600000001000020000000ed33b77801b6476c3299eca9c3968fa00ee3fc80c0b9bd6728942c1a3ce8503f000000000e800000000200002000000000820481d33d6325fcb2a97947624274e99e1ce2a758e19373a9a36330402d5f20000000808c5c8a8c6f784f965c25c71d354c3eea42902fb9983b8c58902120924a40de4000000034f91d325f6f0f5ac8167795ea26c35af65b0fcff8757761745109302471e238f8b6b9c31e5e687ea43f8bff1c8593f93c55111e08d477bf7bd6796d24e91823 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422311237" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1336368462" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1340743647" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1336368462" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31106220" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1074b958aca4da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7B36AB44-109F-11EF-B8C0-D64620966489} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31106220" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b2e58ab8bf361247b7301f68e304ddb200000000020000000000106600000001000020000000f32bc432c0c5207876b710b80a122cd58a4f92e3416484d4dc0d0e723712e7da000000000e8000000002000020000000814f59e70836afaa8a38f03aa701ac7d58bbbc2b24d1a088801cd1b8b8f354d920000000af29914241fe4ec266e3b0f676406ad4eaebcfb297254ea25fae7199e2fe81f840000000b9b52504d0e095a0a97d0b0ef15bbb258b0b713ab7dea85276e6f4fa1b0f72aae3c8f4941a66c57f8287a6d7f8fd83b99c4c0a003116154ee398954749afb784 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002fbe58aca4da01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31106220" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com" 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4464 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 4464 IEXPLORE.EXE 4464 IEXPLORE.EXE 4448 IEXPLORE.EXE 4448 IEXPLORE.EXE 4448 IEXPLORE.EXE 4448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 4548 wrote to memory of 4464 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 89 PID 4548 wrote to memory of 4464 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 89 PID 4464 wrote to memory of 4448 4464 IEXPLORE.EXE 90 PID 4464 wrote to memory of 4448 4464 IEXPLORE.EXE 90 PID 4464 wrote to memory of 4448 4464 IEXPLORE.EXE 90 PID 4548 wrote to memory of 3592 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 91 PID 4548 wrote to memory of 3592 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 91 PID 4548 wrote to memory of 4036 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 92 PID 4548 wrote to memory of 4036 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 92 PID 4548 wrote to memory of 4036 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 92 PID 4036 wrote to memory of 4992 4036 cmd.exe 94 PID 4036 wrote to memory of 4992 4036 cmd.exe 94 PID 4036 wrote to memory of 4992 4036 cmd.exe 94 PID 4548 wrote to memory of 2672 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 95 PID 4548 wrote to memory of 2672 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 95 PID 4548 wrote to memory of 2672 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 95 PID 2672 wrote to memory of 2912 2672 cmd.exe 97 PID 2672 wrote to memory of 2912 2672 cmd.exe 97 PID 2672 wrote to memory of 2912 2672 cmd.exe 97 PID 4548 wrote to memory of 60 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 98 PID 4548 wrote to memory of 60 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 98 PID 4548 wrote to memory of 60 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 98 PID 60 wrote to memory of 4908 60 cmd.exe 100 PID 60 wrote to memory of 4908 60 cmd.exe 100 PID 60 wrote to memory of 4908 60 cmd.exe 100 PID 4548 wrote to memory of 2996 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 102 PID 4548 wrote to memory of 2996 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 102 PID 4548 wrote to memory of 2996 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 102 PID 2996 wrote to memory of 1632 2996 cmd.exe 104 PID 2996 wrote to memory of 1632 2996 cmd.exe 104 PID 2996 wrote to memory of 1632 2996 cmd.exe 104 PID 4548 wrote to memory of 2696 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 106 PID 4548 wrote to memory of 2696 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 106 PID 4548 wrote to memory of 2696 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 106 PID 2696 wrote to memory of 2348 2696 cmd.exe 108 PID 2696 wrote to memory of 2348 2696 cmd.exe 108 PID 2696 wrote to memory of 2348 2696 cmd.exe 108 PID 4548 wrote to memory of 4928 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 109 PID 4548 wrote to memory of 4928 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 109 PID 4548 wrote to memory of 4928 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 109 PID 4928 wrote to memory of 2728 4928 cmd.exe 112 PID 4928 wrote to memory of 2728 4928 cmd.exe 112 PID 4928 wrote to memory of 2728 4928 cmd.exe 112 PID 4548 wrote to memory of 2316 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 113 PID 4548 wrote to memory of 2316 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 113 PID 4548 wrote to memory of 2316 4548 31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe 113 PID 2316 wrote to memory of 864 2316 cmd.exe 115 PID 2316 wrote to memory of 864 2316 cmd.exe 115 PID 2316 wrote to memory of 864 2316 cmd.exe 115 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 2728 attrib.exe 864 attrib.exe 4992 attrib.exe 2912 attrib.exe 4908 attrib.exe 1632 attrib.exe 2348 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe"C:\Users\Admin\AppData\Local\Temp\31c071b2a25fff1a3dcac4c5c4aa4182f9df73802a8b92d9bd09bfb78354711f.exe"1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.212ok.com/Gbook.asp?qita2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4464 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4448
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan2⤵
- Modifies Internet Explorer settings
PID:3592
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:4992
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:2912
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"3⤵
- Views/modifies file attributes
PID:4908
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:1632
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:2348
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\WINDOWS\windows.exe"3⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\attrib.exeattrib +h "c:\system.exe"3⤵
- Views/modifies file attributes
PID:864
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3988,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:81⤵PID:4388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
143KB
MD522feae5fe8811ca4a8dc886adfb298bd
SHA14e890c665e02de140087b49a50ff18f544a5c1ea
SHA2568f03b522646edb74fc6902a9aebfd2b6221f197871678b15082920a172dcc144
SHA5124b653846e25319dbac9c953474b895258a480f519c4ca2cd4fcd62b5a05a8ec9ed18e241ea6310aa275099166342541d40f297d251c1fecee97a065c850e7910
-
Filesize
143KB
MD51659885ff5e1f676c6fc1904fef8a3e6
SHA17a76b8b9ee7aafcf83546316cfeb5d7f135d0e62
SHA25645e4e1c070d61f0e42553ffb9e87440c2051aa60b0137ae1e79f9c4d99800527
SHA512580f2b7978447d06bcd966a31ae52d9d9fd50631e8fb554b8b87b059932d00dd9191e105719e742644d0d1d0bbbb2f895e4bfacb6aed870f8be5449fad965a3e