Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe
Resource
win10v2004-20240508-en
General
-
Target
096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe
-
Size
194KB
-
MD5
7ade2043c36c9e1e74c6a8e5319dea77
-
SHA1
ec702a41ff94390708b3aeeff6b26d53d1fa2fd1
-
SHA256
096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec
-
SHA512
0673fe129ccd97bb2153a4b89d2099c843a50dfe26039c7bbe424fd2cd8e6035e8ff99e7215762aaebf89e02fe54b2f5b73f42bcb1acf0de9a9b4c90cc0d0bef
-
SSDEEP
3072:Hpjxy4jStzsU524Wr2NxsV40pjxy4jStzsU524Wr2NxsV4hfuJ:JjcqB7pKsV42jcqB7pKsV4hWJ
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmlaunch.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPDMC.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Photo Viewer\ImagingDevices.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\java.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Defender\MSASCui.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\jp2launcher.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Journal\Journal.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmpenc.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Journal\PDIALOG.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpenc.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\misc.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmplayer.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\DVD Maker\DVDMaker.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Media Player\setup_wm.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Windows Mail\wab.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ktab.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\policytool.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\sidebar.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\twunk_32.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\winhlp32.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\explorer.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\fveupdate.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\HelpPane.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\splwow64.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\twunk_16.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\bfsvc.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\hh.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\notepad.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\write.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1532 wrote to memory of 2164 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 28 PID 1532 wrote to memory of 2164 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 28 PID 1532 wrote to memory of 2164 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 28 PID 1532 wrote to memory of 2164 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 28 PID 1532 wrote to memory of 1908 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 30 PID 1532 wrote to memory of 1908 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 30 PID 1532 wrote to memory of 1908 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 30 PID 1532 wrote to memory of 1908 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 30 PID 1532 wrote to memory of 1848 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 31 PID 1532 wrote to memory of 1848 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 31 PID 1532 wrote to memory of 1848 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 31 PID 1532 wrote to memory of 1848 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 31 PID 1532 wrote to memory of 2328 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 32 PID 1532 wrote to memory of 2328 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 32 PID 1532 wrote to memory of 2328 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 32 PID 1532 wrote to memory of 2328 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 32 PID 1532 wrote to memory of 932 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 34 PID 1532 wrote to memory of 932 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 34 PID 1532 wrote to memory of 932 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 34 PID 1532 wrote to memory of 932 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 34 PID 1532 wrote to memory of 1684 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 36 PID 1532 wrote to memory of 1684 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 36 PID 1532 wrote to memory of 1684 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 36 PID 1532 wrote to memory of 1684 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 36 PID 1532 wrote to memory of 2868 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 39 PID 1532 wrote to memory of 2868 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 39 PID 1532 wrote to memory of 2868 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 39 PID 1532 wrote to memory of 2868 1532 096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe 39 PID 1908 wrote to memory of 1352 1908 cmd.exe 42 PID 1908 wrote to memory of 1352 1908 cmd.exe 42 PID 1908 wrote to memory of 1352 1908 cmd.exe 42 PID 1908 wrote to memory of 1352 1908 cmd.exe 42 PID 1908 wrote to memory of 2892 1908 cmd.exe 43 PID 1908 wrote to memory of 2892 1908 cmd.exe 43 PID 1908 wrote to memory of 2892 1908 cmd.exe 43 PID 1908 wrote to memory of 2892 1908 cmd.exe 43 PID 1908 wrote to memory of 2264 1908 cmd.exe 44 PID 1908 wrote to memory of 2264 1908 cmd.exe 44 PID 1908 wrote to memory of 2264 1908 cmd.exe 44 PID 1908 wrote to memory of 2264 1908 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe"C:\Users\Admin\AppData\Local\Temp\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:2164
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:1352
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:2892
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:2264
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:1848
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2328
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe2⤵
- Modifies registry class
PID:932
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe2⤵
- Modifies registry class
PID:1684
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\096fe0f906e002d53592aba1016ae3d2043032e8501e4504c0d42bf7f62017ec.exe2⤵
- Modifies registry class
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
194KB
MD5b80f0ca54a90aa7889dd56968d07ce2c
SHA1acaae245868753c7cbd16d184221bbeaf29244f8
SHA25634c5b36cd747fcf6052df5c81c32bb1f87a61644c08597d0a1f6be9c4364b311
SHA512f1fc306fbfa0dcb882a427bc66cabbabb0bb551b26ffc9477b3eaf11216bb318083f22db21f5f3821e4bbe5b8f28b05aedddbaf5466a2759caa2c242eef926a9