Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
Resource
win7-20240508-en
General
-
Target
150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
-
Size
7.9MB
-
MD5
8fb60aacdbae702cef6c315966ef338c
-
SHA1
4935d60a2ee95ddb9c807a52a9d98c28f1331790
-
SHA256
150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294
-
SHA512
096e57960aa0c66426555e0899f3ad7c095abc757d136ff5bcf14c5e692a4e6f51a565ddea23dfdd22002bb206e26a3235ee996be29b2112ee7ac6467221e437
-
SSDEEP
196608:fWT9nO7WymnHhWAwJOwDuEwUdMDSOyIN9fhjtTYIYYmKL+cqCf4J:V7BUWAwJOEujUdM2OyG9VtUIYdHY8
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2180-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2180-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2180-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2784-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2784-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2912-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2912-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2912-51-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral1/memory/2180-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2180-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2180-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2784-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/files/0x00080000000148ac-27.dat family_gh0strat behavioral1/memory/2784-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2912-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2912-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2912-51-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259396715.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
pid Process 2180 svchost.exe 2784 TXPlatforn.exe 2712 svchos.exe 2912 TXPlatforn.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 668 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
pid Process 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2784 TXPlatforn.exe 2712 svchos.exe 2648 svchost.exe 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2648 svchost.exe 668 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
resource yara_rule behavioral1/memory/2180-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2180-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2180-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2180-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2784-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2784-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-51-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259396715.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003a29d685a776db18b672b49ff0d7cb5cebc9cda725bd6013aa0a3aacfcfac300000000000e8000000002000020000000dabc99f22bf1b5afdb2936fab251491cdcbd469a07f3ef9588ccd4e90c8a713b90000000145a445b7238163dd76788d92bdc4b3698d0b7f5d70cae9710acaef8db102ea69b7bd6dd44d699eaf086ea065dec3170811f730a12bcc276836a2b284a37a66d75628606008f653f06245cbd3197416500faea8343031249d23a0f60a08d57293ba216bfe8f721bb94bb25af0b1a98b78b7c086a7b96e00603c324ea3998a81f949102a6fe234506826667e4075d9c11400000009bbb5fe88c88bba82d998998a80d9c4c25ea94345e675a1bdbba69e17698ad685458ea8542ccc04453e1f20eacd9626e65dedcc8762b1f14786f36bd53fd5360 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000521e1d777695bd9abe2faefc23e683145bdd3cbb31769e42c2804117dc848b94000000000e800000000200002000000062e93f3bcbbb7e762de8fc1c0a9a2ceb02d5bc6ae7a21917dff76fcc018ea90c20000000a2b4e25c26e0b694e1ed90598d26569e3aeba5b5456a750e02fdf5f2d3b7438240000000249c7494b9998c39fcfe9344bde940e7b794686c3179ba615969fa4cb55dd7dad803dbb4b676f72376a89feeed0395fef6a62a1ab9b5d0a7ff363a56d5c09935 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205d88a6f6c6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425478392" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0F28A01-32E9-11EF-8189-4637C9E50E53} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2668 PING.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2912 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2180 svchost.exe Token: SeLoadDriverPrivilege 2912 TXPlatforn.exe Token: 33 2912 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2912 TXPlatforn.exe Token: 33 2912 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2912 TXPlatforn.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 844 iexplore.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 844 iexplore.exe 844 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2180 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 28 PID 1852 wrote to memory of 2180 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 28 PID 1852 wrote to memory of 2180 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 28 PID 1852 wrote to memory of 2180 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 28 PID 1852 wrote to memory of 2180 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 28 PID 1852 wrote to memory of 2180 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 28 PID 1852 wrote to memory of 2180 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 28 PID 2180 wrote to memory of 2656 2180 svchost.exe 30 PID 2180 wrote to memory of 2656 2180 svchost.exe 30 PID 2180 wrote to memory of 2656 2180 svchost.exe 30 PID 2180 wrote to memory of 2656 2180 svchost.exe 30 PID 1852 wrote to memory of 2712 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 32 PID 1852 wrote to memory of 2712 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 32 PID 1852 wrote to memory of 2712 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 32 PID 1852 wrote to memory of 2712 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 32 PID 2656 wrote to memory of 2668 2656 cmd.exe 34 PID 2656 wrote to memory of 2668 2656 cmd.exe 34 PID 2656 wrote to memory of 2668 2656 cmd.exe 34 PID 2656 wrote to memory of 2668 2656 cmd.exe 34 PID 2784 wrote to memory of 2912 2784 TXPlatforn.exe 33 PID 2784 wrote to memory of 2912 2784 TXPlatforn.exe 33 PID 2784 wrote to memory of 2912 2784 TXPlatforn.exe 33 PID 2784 wrote to memory of 2912 2784 TXPlatforn.exe 33 PID 2784 wrote to memory of 2912 2784 TXPlatforn.exe 33 PID 2784 wrote to memory of 2912 2784 TXPlatforn.exe 33 PID 2784 wrote to memory of 2912 2784 TXPlatforn.exe 33 PID 1852 wrote to memory of 2588 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 37 PID 1852 wrote to memory of 2588 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 37 PID 1852 wrote to memory of 2588 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 37 PID 1852 wrote to memory of 2588 1852 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 37 PID 2648 wrote to memory of 668 2648 svchost.exe 39 PID 2648 wrote to memory of 668 2648 svchost.exe 39 PID 2648 wrote to memory of 668 2648 svchost.exe 39 PID 2648 wrote to memory of 668 2648 svchost.exe 39 PID 2588 wrote to memory of 844 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 40 PID 2588 wrote to memory of 844 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 40 PID 2588 wrote to memory of 844 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 40 PID 2588 wrote to memory of 844 2588 HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe 40 PID 844 wrote to memory of 2484 844 iexplore.exe 41 PID 844 wrote to memory of 2484 844 iexplore.exe 41 PID 844 wrote to memory of 2484 844 iexplore.exe 41 PID 844 wrote to memory of 2484 844 iexplore.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe"C:\Users\Admin\AppData\Local\Temp\150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exeC:\Users\Admin\AppData\Local\Temp\HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://dl.ludashi.com/ludashi/ludashisetup.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
-
-
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2548
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259396715.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Server Software Component
1Terminal Services DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD551a65d2eeb7ad33c64c0708bb1de986d
SHA1d5b7d6729fab76c66b20b9dbc74a5b4db89d41cf
SHA256e537cfd89fafed897417a222838f460d30b9092db5f5e9f27766fd511b74d55f
SHA512acc0c5a91c32b32418f5145314b3dc1b203ad1e21396fe8ce3c7f353f20c4ac87576691dd870b425e0519e5dc163bb9aaebddfe49e73a6cf895c3b13587c2c5e
-
Filesize
1.5MB
MD5272bedf8d490dba91c7657b955d61c22
SHA1529cd24a7bba3d88948619763f549e6e85f2b8e8
SHA2560822eae1f2e85712b1c3afb7e37bffd34262b0207c409ccbe89173e9e9bd7465
SHA512e42f270eb4cc35041cef3d6ed4bf713abbcdb741d2514f28fefd98787828b6be788b91a4487187ed36fa4725b45de87573a42f5421a73d36b3794506ab35c58b
-
\Users\Admin\AppData\Local\Temp\HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
Filesize6.4MB
MD5433333d95590d6987cd2255701e0974c
SHA17a15a5d3dd68d8a3ff1b5ce0742ba8da0618bc07
SHA256dbef829a072c41161020cf3f7b10754ee73071ed09e77ed3b7f8b9843d1dfd3b
SHA512e420b2a6201b4a29974ad236491506501b8eec81d710ce20a9e55328085ed848d452e87f7d73dbf1320928f52bf8f094f40883614451f9f058c0c51150444dd4
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD5fc928b3ff6b0dfb30b0bb48b1a7d9e5b
SHA13d8462a2ccb344a74f3c6d88d1cfb7ce06507cae
SHA256498b6b6b17b98fa2e0d232a4cc53e1d7e864b9546044975344238cadb3b208e3
SHA51235f7855253f1d5debcc1e9e09c6584c343e09df357e9520e24c1c2a8adb36f240351edf7b7203983c42067128b12aded46f72de72637ba39c533c94549ef6c71
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d