Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe
Resource
win10v2004-20240426-en
General
-
Target
d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe
-
Size
124KB
-
MD5
251fb1d38be020bdaed4c7a9b6413f42
-
SHA1
d04cf0dc47c075f7fd74381b219a0446cf72840c
-
SHA256
d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f
-
SHA512
f3e088ba4a420b80584137b1a3588fc8cb5a87680c2208d2cda30a606d3a8e101622190a66a5baaaa1924f26c9bd8f33bc68e175f3ada4d5a562c53619a8c31c
-
SSDEEP
1536:q8sz/5YDYvhRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmE:dGBYChkFoN3Oo1+FvfSW
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 46 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" maeciif.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wooxeq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fwhid.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xiejioc.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yeuziew.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yeoitav.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jeinur.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" waaaxan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sieonid.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" viuwoav.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xeeim.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yaeacos.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kiumae.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fueiyay.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baueli.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zoamii.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tahat.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" giiuceh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quauti.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" caounu.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laokuic.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" suexuh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" raeut.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" peeres.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xeualu.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kxliy.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diavuu.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ntnar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeecoe.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" veoijo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" voiazu.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taoku.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" soopa.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yuiah.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wywaeq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" niayes.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" miaoqex.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zqyiq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mtkac.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hnnew.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xoeqeo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sqnap.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qofih.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pouaj.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dozir.exe -
Executes dropped EXE 46 IoCs
pid Process 2584 yeuziew.exe 2536 kxliy.exe 2588 maeciif.exe 2296 kiumae.exe 2368 zeecoe.exe 1864 caounu.exe 2280 veoijo.exe 1604 fueiyay.exe 2932 baueli.exe 2204 voiazu.exe 704 hnnew.exe 2364 yeoitav.exe 3064 jeinur.exe 1700 laokuic.exe 2824 wooxeq.exe 1668 waaaxan.exe 2664 xoeqeo.exe 2220 sqnap.exe 2388 taoku.exe 2012 zoamii.exe 112 tahat.exe 2180 suexuh.exe 1452 raeut.exe 2196 soopa.exe 1412 qofih.exe 1920 xeeim.exe 1956 sieonid.exe 1912 yuiah.exe 1500 pouaj.exe 1848 peeres.exe 2704 dozir.exe 2576 wywaeq.exe 2572 mtkac.exe 816 diavuu.exe 2044 xeualu.exe 1724 fwhid.exe 2348 niayes.exe 1732 yaeacos.exe 1656 xiejioc.exe 2564 giiuceh.exe 356 miaoqex.exe 3000 viuwoav.exe 2852 quauti.exe 1280 zqyiq.exe 2904 ntnar.exe 2448 biibeoh.exe -
Loads dropped DLL 64 IoCs
pid Process 2860 d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe 2860 d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe 2584 yeuziew.exe 2584 yeuziew.exe 2536 kxliy.exe 2536 kxliy.exe 2588 maeciif.exe 2588 maeciif.exe 2296 kiumae.exe 2296 kiumae.exe 2368 zeecoe.exe 2368 zeecoe.exe 1864 caounu.exe 1864 caounu.exe 2280 veoijo.exe 2280 veoijo.exe 1604 fueiyay.exe 1604 fueiyay.exe 2932 baueli.exe 2932 baueli.exe 2204 voiazu.exe 2204 voiazu.exe 704 hnnew.exe 704 hnnew.exe 2364 yeoitav.exe 2364 yeoitav.exe 3064 jeinur.exe 3064 jeinur.exe 1700 laokuic.exe 1700 laokuic.exe 2824 wooxeq.exe 2824 wooxeq.exe 1668 waaaxan.exe 1668 waaaxan.exe 2664 xoeqeo.exe 2664 xoeqeo.exe 2220 sqnap.exe 2220 sqnap.exe 2388 taoku.exe 2388 taoku.exe 2012 zoamii.exe 2012 zoamii.exe 112 tahat.exe 112 tahat.exe 2180 suexuh.exe 2180 suexuh.exe 1452 raeut.exe 1452 raeut.exe 2196 soopa.exe 2196 soopa.exe 1412 qofih.exe 1412 qofih.exe 1920 xeeim.exe 1920 xeeim.exe 1956 sieonid.exe 1956 sieonid.exe 1912 yuiah.exe 1912 yuiah.exe 1500 pouaj.exe 1500 pouaj.exe 1848 peeres.exe 1848 peeres.exe 2704 dozir.exe 2704 dozir.exe -
Adds Run key to start application 2 TTPs 46 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeualu = "C:\\Users\\Admin\\xeualu.exe /V" diavuu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\fwhid = "C:\\Users\\Admin\\fwhid.exe /L" xeualu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeecoe = "C:\\Users\\Admin\\zeecoe.exe /C" kiumae.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\caounu = "C:\\Users\\Admin\\caounu.exe /v" zeecoe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\jeinur = "C:\\Users\\Admin\\jeinur.exe /d" yeoitav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\laokuic = "C:\\Users\\Admin\\laokuic.exe /i" jeinur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\tahat = "C:\\Users\\Admin\\tahat.exe /y" zoamii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuiah = "C:\\Users\\Admin\\yuiah.exe /M" sieonid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuwoav = "C:\\Users\\Admin\\viuwoav.exe /w" miaoqex.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeut = "C:\\Users\\Admin\\raeut.exe /P" suexuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\soopa = "C:\\Users\\Admin\\soopa.exe /j" raeut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\qofih = "C:\\Users\\Admin\\qofih.exe /C" soopa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtkac = "C:\\Users\\Admin\\mtkac.exe /H" wywaeq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\diavuu = "C:\\Users\\Admin\\diavuu.exe /G" mtkac.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\biibeoh = "C:\\Users\\Admin\\biibeoh.exe /N" ntnar.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntnar = "C:\\Users\\Admin\\ntnar.exe /W" zqyiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hnnew = "C:\\Users\\Admin\\hnnew.exe /r" voiazu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\suexuh = "C:\\Users\\Admin\\suexuh.exe /z" tahat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\sieonid = "C:\\Users\\Admin\\sieonid.exe /b" xeeim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\pouaj = "C:\\Users\\Admin\\pouaj.exe /r" yuiah.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\peeres = "C:\\Users\\Admin\\peeres.exe /b" pouaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\quauti = "C:\\Users\\Admin\\quauti.exe /E" viuwoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiumae = "C:\\Users\\Admin\\kiumae.exe /s" maeciif.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeeim = "C:\\Users\\Admin\\xeeim.exe /X" qofih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiejioc = "C:\\Users\\Admin\\xiejioc.exe /D" yaeacos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\giiuceh = "C:\\Users\\Admin\\giiuceh.exe /n" xiejioc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dozir = "C:\\Users\\Admin\\dozir.exe /Q" peeres.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\zqyiq = "C:\\Users\\Admin\\zqyiq.exe /e" quauti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\kxliy = "C:\\Users\\Admin\\kxliy.exe /K" yeuziew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\fueiyay = "C:\\Users\\Admin\\fueiyay.exe /Q" veoijo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\voiazu = "C:\\Users\\Admin\\voiazu.exe /I" baueli.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\wooxeq = "C:\\Users\\Admin\\wooxeq.exe /l" laokuic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\xoeqeo = "C:\\Users\\Admin\\xoeqeo.exe /s" waaaxan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\taoku = "C:\\Users\\Admin\\taoku.exe /I" sqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeuziew = "C:\\Users\\Admin\\yeuziew.exe /L" d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeoitav = "C:\\Users\\Admin\\yeoitav.exe /n" hnnew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\sqnap = "C:\\Users\\Admin\\sqnap.exe /P" xoeqeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\wywaeq = "C:\\Users\\Admin\\wywaeq.exe /W" dozir.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\niayes = "C:\\Users\\Admin\\niayes.exe /s" fwhid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaeacos = "C:\\Users\\Admin\\yaeacos.exe /Q" niayes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\maeciif = "C:\\Users\\Admin\\maeciif.exe /A" kxliy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoijo = "C:\\Users\\Admin\\veoijo.exe /k" caounu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\baueli = "C:\\Users\\Admin\\baueli.exe /R" fueiyay.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\waaaxan = "C:\\Users\\Admin\\waaaxan.exe /g" wooxeq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoamii = "C:\\Users\\Admin\\zoamii.exe /z" taoku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\miaoqex = "C:\\Users\\Admin\\miaoqex.exe /w" giiuceh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2860 d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe 2584 yeuziew.exe 2536 kxliy.exe 2588 maeciif.exe 2296 kiumae.exe 2368 zeecoe.exe 1864 caounu.exe 2280 veoijo.exe 1604 fueiyay.exe 2932 baueli.exe 2204 voiazu.exe 704 hnnew.exe 2364 yeoitav.exe 3064 jeinur.exe 1700 laokuic.exe 2824 wooxeq.exe 1668 waaaxan.exe 2664 xoeqeo.exe 2220 sqnap.exe 2388 taoku.exe 2012 zoamii.exe 112 tahat.exe 2180 suexuh.exe 1452 raeut.exe 2196 soopa.exe 1412 qofih.exe 1920 xeeim.exe 1956 sieonid.exe 1912 yuiah.exe 1500 pouaj.exe 1848 peeres.exe 2704 dozir.exe 2576 wywaeq.exe 2572 mtkac.exe 816 diavuu.exe 2044 xeualu.exe 1724 fwhid.exe 2348 niayes.exe 1732 yaeacos.exe 1656 xiejioc.exe 2564 giiuceh.exe 356 miaoqex.exe 3000 viuwoav.exe 2852 quauti.exe 1280 zqyiq.exe 2904 ntnar.exe -
Suspicious use of SetWindowsHookEx 47 IoCs
pid Process 2860 d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe 2584 yeuziew.exe 2536 kxliy.exe 2588 maeciif.exe 2296 kiumae.exe 2368 zeecoe.exe 1864 caounu.exe 2280 veoijo.exe 1604 fueiyay.exe 2932 baueli.exe 2204 voiazu.exe 704 hnnew.exe 2364 yeoitav.exe 3064 jeinur.exe 1700 laokuic.exe 2824 wooxeq.exe 1668 waaaxan.exe 2664 xoeqeo.exe 2220 sqnap.exe 2388 taoku.exe 2012 zoamii.exe 112 tahat.exe 2180 suexuh.exe 1452 raeut.exe 2196 soopa.exe 1412 qofih.exe 1920 xeeim.exe 1956 sieonid.exe 1912 yuiah.exe 1500 pouaj.exe 1848 peeres.exe 2704 dozir.exe 2576 wywaeq.exe 2572 mtkac.exe 816 diavuu.exe 2044 xeualu.exe 1724 fwhid.exe 2348 niayes.exe 1732 yaeacos.exe 1656 xiejioc.exe 2564 giiuceh.exe 356 miaoqex.exe 3000 viuwoav.exe 2852 quauti.exe 1280 zqyiq.exe 2904 ntnar.exe 2448 biibeoh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2584 2860 d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe 28 PID 2860 wrote to memory of 2584 2860 d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe 28 PID 2860 wrote to memory of 2584 2860 d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe 28 PID 2860 wrote to memory of 2584 2860 d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe 28 PID 2584 wrote to memory of 2536 2584 yeuziew.exe 29 PID 2584 wrote to memory of 2536 2584 yeuziew.exe 29 PID 2584 wrote to memory of 2536 2584 yeuziew.exe 29 PID 2584 wrote to memory of 2536 2584 yeuziew.exe 29 PID 2536 wrote to memory of 2588 2536 kxliy.exe 30 PID 2536 wrote to memory of 2588 2536 kxliy.exe 30 PID 2536 wrote to memory of 2588 2536 kxliy.exe 30 PID 2536 wrote to memory of 2588 2536 kxliy.exe 30 PID 2588 wrote to memory of 2296 2588 maeciif.exe 31 PID 2588 wrote to memory of 2296 2588 maeciif.exe 31 PID 2588 wrote to memory of 2296 2588 maeciif.exe 31 PID 2588 wrote to memory of 2296 2588 maeciif.exe 31 PID 2296 wrote to memory of 2368 2296 kiumae.exe 32 PID 2296 wrote to memory of 2368 2296 kiumae.exe 32 PID 2296 wrote to memory of 2368 2296 kiumae.exe 32 PID 2296 wrote to memory of 2368 2296 kiumae.exe 32 PID 2368 wrote to memory of 1864 2368 zeecoe.exe 33 PID 2368 wrote to memory of 1864 2368 zeecoe.exe 33 PID 2368 wrote to memory of 1864 2368 zeecoe.exe 33 PID 2368 wrote to memory of 1864 2368 zeecoe.exe 33 PID 1864 wrote to memory of 2280 1864 caounu.exe 34 PID 1864 wrote to memory of 2280 1864 caounu.exe 34 PID 1864 wrote to memory of 2280 1864 caounu.exe 34 PID 1864 wrote to memory of 2280 1864 caounu.exe 34 PID 2280 wrote to memory of 1604 2280 veoijo.exe 35 PID 2280 wrote to memory of 1604 2280 veoijo.exe 35 PID 2280 wrote to memory of 1604 2280 veoijo.exe 35 PID 2280 wrote to memory of 1604 2280 veoijo.exe 35 PID 1604 wrote to memory of 2932 1604 fueiyay.exe 36 PID 1604 wrote to memory of 2932 1604 fueiyay.exe 36 PID 1604 wrote to memory of 2932 1604 fueiyay.exe 36 PID 1604 wrote to memory of 2932 1604 fueiyay.exe 36 PID 2932 wrote to memory of 2204 2932 baueli.exe 37 PID 2932 wrote to memory of 2204 2932 baueli.exe 37 PID 2932 wrote to memory of 2204 2932 baueli.exe 37 PID 2932 wrote to memory of 2204 2932 baueli.exe 37 PID 2204 wrote to memory of 704 2204 voiazu.exe 38 PID 2204 wrote to memory of 704 2204 voiazu.exe 38 PID 2204 wrote to memory of 704 2204 voiazu.exe 38 PID 2204 wrote to memory of 704 2204 voiazu.exe 38 PID 704 wrote to memory of 2364 704 hnnew.exe 39 PID 704 wrote to memory of 2364 704 hnnew.exe 39 PID 704 wrote to memory of 2364 704 hnnew.exe 39 PID 704 wrote to memory of 2364 704 hnnew.exe 39 PID 2364 wrote to memory of 3064 2364 yeoitav.exe 40 PID 2364 wrote to memory of 3064 2364 yeoitav.exe 40 PID 2364 wrote to memory of 3064 2364 yeoitav.exe 40 PID 2364 wrote to memory of 3064 2364 yeoitav.exe 40 PID 3064 wrote to memory of 1700 3064 jeinur.exe 41 PID 3064 wrote to memory of 1700 3064 jeinur.exe 41 PID 3064 wrote to memory of 1700 3064 jeinur.exe 41 PID 3064 wrote to memory of 1700 3064 jeinur.exe 41 PID 1700 wrote to memory of 2824 1700 laokuic.exe 44 PID 1700 wrote to memory of 2824 1700 laokuic.exe 44 PID 1700 wrote to memory of 2824 1700 laokuic.exe 44 PID 1700 wrote to memory of 2824 1700 laokuic.exe 44 PID 2824 wrote to memory of 1668 2824 wooxeq.exe 45 PID 2824 wrote to memory of 1668 2824 wooxeq.exe 45 PID 2824 wrote to memory of 1668 2824 wooxeq.exe 45 PID 2824 wrote to memory of 1668 2824 wooxeq.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe"C:\Users\Admin\AppData\Local\Temp\d4b8fec03edbcefd0d0aadf5f1cb3ab10bd323d2d30d71d0b64111c3e4903f0f.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\yeuziew.exe"C:\Users\Admin\yeuziew.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\kxliy.exe"C:\Users\Admin\kxliy.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\maeciif.exe"C:\Users\Admin\maeciif.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\kiumae.exe"C:\Users\Admin\kiumae.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\zeecoe.exe"C:\Users\Admin\zeecoe.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\caounu.exe"C:\Users\Admin\caounu.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\veoijo.exe"C:\Users\Admin\veoijo.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\fueiyay.exe"C:\Users\Admin\fueiyay.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\baueli.exe"C:\Users\Admin\baueli.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\voiazu.exe"C:\Users\Admin\voiazu.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\hnnew.exe"C:\Users\Admin\hnnew.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\yeoitav.exe"C:\Users\Admin\yeoitav.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\jeinur.exe"C:\Users\Admin\jeinur.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\laokuic.exe"C:\Users\Admin\laokuic.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\wooxeq.exe"C:\Users\Admin\wooxeq.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\waaaxan.exe"C:\Users\Admin\waaaxan.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1668 -
C:\Users\Admin\xoeqeo.exe"C:\Users\Admin\xoeqeo.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Users\Admin\sqnap.exe"C:\Users\Admin\sqnap.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2220 -
C:\Users\Admin\taoku.exe"C:\Users\Admin\taoku.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2388 -
C:\Users\Admin\zoamii.exe"C:\Users\Admin\zoamii.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2012 -
C:\Users\Admin\tahat.exe"C:\Users\Admin\tahat.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:112 -
C:\Users\Admin\suexuh.exe"C:\Users\Admin\suexuh.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Users\Admin\raeut.exe"C:\Users\Admin\raeut.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1452 -
C:\Users\Admin\soopa.exe"C:\Users\Admin\soopa.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2196 -
C:\Users\Admin\qofih.exe"C:\Users\Admin\qofih.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1412 -
C:\Users\Admin\xeeim.exe"C:\Users\Admin\xeeim.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1920 -
C:\Users\Admin\sieonid.exe"C:\Users\Admin\sieonid.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1956 -
C:\Users\Admin\yuiah.exe"C:\Users\Admin\yuiah.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1912 -
C:\Users\Admin\pouaj.exe"C:\Users\Admin\pouaj.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1500 -
C:\Users\Admin\peeres.exe"C:\Users\Admin\peeres.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1848 -
C:\Users\Admin\dozir.exe"C:\Users\Admin\dozir.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2704 -
C:\Users\Admin\wywaeq.exe"C:\Users\Admin\wywaeq.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2576 -
C:\Users\Admin\mtkac.exe"C:\Users\Admin\mtkac.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2572 -
C:\Users\Admin\diavuu.exe"C:\Users\Admin\diavuu.exe"35⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:816 -
C:\Users\Admin\xeualu.exe"C:\Users\Admin\xeualu.exe"36⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2044 -
C:\Users\Admin\fwhid.exe"C:\Users\Admin\fwhid.exe"37⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Users\Admin\niayes.exe"C:\Users\Admin\niayes.exe"38⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2348 -
C:\Users\Admin\yaeacos.exe"C:\Users\Admin\yaeacos.exe"39⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1732 -
C:\Users\Admin\xiejioc.exe"C:\Users\Admin\xiejioc.exe"40⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Users\Admin\giiuceh.exe"C:\Users\Admin\giiuceh.exe"41⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2564 -
C:\Users\Admin\miaoqex.exe"C:\Users\Admin\miaoqex.exe"42⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:356 -
C:\Users\Admin\viuwoav.exe"C:\Users\Admin\viuwoav.exe"43⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Users\Admin\quauti.exe"C:\Users\Admin\quauti.exe"44⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Users\Admin\zqyiq.exe"C:\Users\Admin\zqyiq.exe"45⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1280 -
C:\Users\Admin\ntnar.exe"C:\Users\Admin\ntnar.exe"46⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2904 -
C:\Users\Admin\biibeoh.exe"C:\Users\Admin\biibeoh.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5b46e61176be628b287b5db0b7b159e06
SHA1b480521365c207717eb85347460836aff9bbe6e5
SHA256db906041ec08011c8c3a9de52545caf0446c2c35066ba7bc4ef7cd397609fb07
SHA5126dcd7676b7df3c8e3849407f785afeffe99d1c6fe13f2830b13a119a463fb4a18150ae5d3437aa5652d197e6fc98c95fa128d9d5d454d80851f67789e6c75011
-
Filesize
124KB
MD59e98552432539763647968e2c3da45a7
SHA153615802f4232f8a6265ad3b5557d0f9d36fba2d
SHA2568e7f938fd300cec4512aad042f608fc0d1c8a78ff064710fd21a59e269174bf8
SHA5129757a48e37e124d81f1c21bee0ae35ac884d3717216826b1a5dae2bfbe2b2bff09fb5c403f944e332c56757e14df8838418ee3cd912284b12726dc7617857f8c
-
Filesize
124KB
MD5728b615fc7c8f8f1dc61a717f47b824c
SHA17f3c9e044b71594896f6126a863c207c956f7e3a
SHA256f30b4cc9b34d6a6ed1661411732f4fd5328498ff0e3e467294e0d250a44a5fd4
SHA5120d3f634383cae4d06520c5a83bc737520f31e8cc98dd9b96dd1fcb3d9c3ed5ba4c6a580113089ef7904c196b513cebe8806899fc1c312a84b9b7637c8f36701f
-
Filesize
124KB
MD5e0fac305b3f7b9747125d615f86f255d
SHA1c3e62e1c1986bbc83fa9eb2dae3f4a71b115e9b3
SHA256fe60554bb92204ef76d2aecbe6beba9e1209ce09c93fbbcf6944266f72dd6c53
SHA512ea0483df0240317091b5f19220879268c0f1de217d91a02e6e4eb62044e6a592aa3b104060b4a1c2a0bddffa43b64ecd3f16e714faa54bf231390d8cf889cfc8
-
Filesize
124KB
MD52bff72f6d142081410cd427fbbc7b037
SHA1a073186a6c9b73db157dcbdad2765ab9f6c1b1ef
SHA2569e5bc9568b4e41abcd810c655b20f3f970c2e7202a0d767dd5ad1b8fa8f3f3bc
SHA512025ad56a260e40053556a6d68eb186e7a611fcecff2c54c4ff244dee566bf60ed837943f47cb331ab4235594f7a10f49ee187f66a3c8f483d50ee93dfe31c9da
-
Filesize
124KB
MD54c7797f479edd4427cda3bf117f1c70a
SHA1a0136d8e23dbdbe9769df1069573e84327c80e51
SHA2563566c8234cef76567412cf799e53960144d07d70a961ff7a21f5bc099e6a795a
SHA512fa7e2396fbdeae6f00286d27559ae8a9fa96c6cafe608c2d5cc10203533bd3565ebd8f5cffbde4e10b784d16ef2f5b6067cac3d3812707c6dd52652dbcd0dbf7
-
Filesize
124KB
MD513b16168da5e2454ba389721f3c54d98
SHA14a462016b22c935b2eb7405eb7f8133491a3aff5
SHA256a1a7e4270ed40cbfba5b1c7835131ded5e0654ee07ab6e9c26458688782b0d85
SHA5129f120cd00f871a0cc19664824575b428f688c04f575a0749e2a3c71c6bb30b2a0e05c8b75ceeb357630caa559dc83dce2412c0cb5d6c104a3f9b0c8349141b65
-
Filesize
124KB
MD5f49a4b6f352a7e01ee5efb85eff9101c
SHA1bc0db07f282927c796c1f7d12225922ac31766d5
SHA2561f568a34d5b03a8a4cbf623701a1b2536bf1077d0d0e204d9a2e37146fe8a1d1
SHA512881b9a8b579e92191b4faec44e3f69bb033c54d6b31fdb541f00f0859f2bf2f148b507ffb589565ad08b137c0bfa96355f811f5e58c1c1119b5f2c4c8b00d5ab
-
Filesize
124KB
MD544e7d2c34789519e077062cc1d6ac9a8
SHA179ace6b381049993e883a3eef266e66c26111dc6
SHA256e22eefc02c6a9e1890eada0718a8b50f81ffe5b05e56cffa81c5cce80e0cd4c8
SHA5123933a0d8668284d1f71ece2f574b28237a7292d75aa6bf5e95f1810d4d5635ac05201de963af4f1111dce83611e47a57794ea635e1258b0aba59fd0e89cb95d7
-
Filesize
124KB
MD5bd6627fbd5d27b7f2b9563c5999cacf5
SHA115ba263c00ab69b40c7f2d5633b6b28234f82d52
SHA256945e4334253057f8bf90197e0df5910afc25de8993e6bcfc2861e8aa36d18baa
SHA51266096f85cdeb908b5a17ab652d9ae8f7a40a9096df849f4de246dbbf2ee912838351c4af3e6bd4f9f1127d8dfc13f6eaabdc3d2dc2d1afb968cccb1d349bddcf
-
Filesize
124KB
MD50b4fce57d9ff38a0bbaffc75b94fc2e9
SHA108bcce75ef7a8eeaa00b9d496bc4698193361bf4
SHA256f7322bafccbe8f966441ce4f8bdd2697d7bacd003cd257c5f8afd6e919c72f88
SHA5129b0ad623ab414243e61e1d11a24c8545e1229dd408ca73f3b4e376bc9ad4d1fc298b3901986b85d2c81cd080be4eaa7c7a0765cee2f6e2cca851fc7eae490fac
-
Filesize
124KB
MD541df14f895bea434fd2866700860c6f6
SHA1c7963476583c0b7691d25d038d416ebdde74be19
SHA2561730cdc4741c17be7e374fc602d8061da4120906097b831f83250b4fca787c2c
SHA512eeb9a2039bc2a3c2d6481b4ee160d355581bb466d2ccd5f02ea0b955065e5a5a9a89dc9615b26cf64dd040f353aef379554847b17b228302bd6be791707cd01e
-
Filesize
124KB
MD591c991b3b97b3393b83f567c3d7c5969
SHA1bb2e82b8b41e714a024950df797b0606d7708927
SHA2562ace63688a21944c57759c9db32e444f201ef589783cdb0b943b419859d5e918
SHA51283381476476c33e74c8f8fb8e460bcf74d2952c16664e3ab8ba6125f2cb74c958acd14ddbb6625ab896691eef04484949432fcfe17068a3cf213d2b25d997677
-
Filesize
124KB
MD5f80da593c4176b5b2dfa8f293996ee2c
SHA16bb7c4ef04f5a152c0bfdd2106ef3f0bc83f14d3
SHA256a35f5518b1718fc64670c6beaefa44af1ea36f05c10545837204de6c8ba7c7cd
SHA5122c078f8ee97248f6bcfb0987397f854762bd045bfb75f0c1c1151a0e61867e17f5abb6a4d0a56b5f6195b2742728c2e2f0572469f7e9cb90687635fe15030d21
-
Filesize
124KB
MD52103c2c5d09a700485c003cbcd7a41df
SHA1acf8681b494f7a95b5dbafb81b847b1a9b60a093
SHA2568e99c00284a71479ee1b2921e60769f0c49c50ad9226abc3017d44cd1ade26d5
SHA51265a2606a7799cabdfe5231dafc8122f9e7e5ee75e957c19a28d1a69543c117be78c73e9d040f17b6df8a98c76221abc564d0658d6198b3c7596c56fb63b34acd
-
Filesize
124KB
MD544efa8db0928b92acdc44ac945baf215
SHA1f49cac154794ae2be65bcf45115e0219cab6d51b
SHA256f5187c5f5ec203ce0d1d5d514a16ebfb5b6b5f4abc6e469d3cafd6d2191a2b60
SHA512ac0e2071a667f8495329a6c112c22b1b34bda4da24c95c99593f33f9959c020face1f33cfd1bfe2acae50fffa42f82e24c41ffe2ae24ff56be3a5cf6952c1b09