Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
71d92358a0d...32.exe
windows7-x64
71d92358a0d...32.exe
windows10-2004-x64
7$PLUGINSDI...ig.dll
windows7-x64
3$PLUGINSDI...ig.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...el.dll
windows7-x64
7$PLUGINSDI...el.dll
windows10-2004-x64
7$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/fct.dll
windows7-x64
3$PLUGINSDIR/fct.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3EasyOn.dll
windows7-x64
6EasyOn.dll
windows10-2004-x64
6EasyOn.exe
windows7-x64
6EasyOn.exe
windows10-2004-x64
6Analysis
-
max time kernel
94s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 02:19
Behavioral task
behavioral1
Sample
1d92358a0d53be94828b970e791ba032.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1d92358a0d53be94828b970e791ba032.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/fct.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/fct.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
EasyOn.dll
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
EasyOn.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
EasyOn.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
EasyOn.exe
Resource
win10v2004-20240508-en
General
-
Target
1d92358a0d53be94828b970e791ba032.exe
-
Size
248KB
-
MD5
1d92358a0d53be94828b970e791ba032
-
SHA1
6c8ba357a09015d04f84badb3d6b213f50a768e0
-
SHA256
2f0ea88279a54e8ebf9beabd8e231b3e7e3e4ca4b6218868b58e72e9dccd2208
-
SHA512
512ab07a7a9f8d3cd75a47d0d52833199e40058248d9121712b1d9d928ec0ddae037c07bcf35d89413afe2fd1e26b3b80b8e6a4b7df627951825523ed5bb6ec4
-
SSDEEP
6144:NH1r2W75+ZPPfnE2Qyn20UG8BH2pnOjCuORE3SDnuM75+ZPPfnE2Qyn20UI:51r2WF+ZPPfnEUnVY2pOjenPF+ZPPfnF
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000800000002340f-55.dat acprotect behavioral2/memory/560-58-0x0000000074C80000-0x0000000074C89000-memory.dmp acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 1d92358a0d53be94828b970e791ba032.exe -
Deletes itself 1 IoCs
pid Process 2976 explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 8 EasyOn.exe -
Loads dropped DLL 12 IoCs
pid Process 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 1852 regsvr32.exe 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 4728 regsvr32.exe 560 1d92358a0d53be94828b970e791ba032.exe -
resource yara_rule behavioral2/memory/560-0-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral2/files/0x000800000002340f-55.dat upx behavioral2/memory/560-58-0x0000000074C80000-0x0000000074C89000-memory.dmp upx behavioral2/memory/560-72-0x0000000000400000-0x0000000000445000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EasyOn = "C:\\Program Files (x86)\\EasyOn\\EasyOn.exe" EasyOn.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 560 set thread context of 2976 560 1d92358a0d53be94828b970e791ba032.exe 85 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\EasyOn\EasyOn.dll 1d92358a0d53be94828b970e791ba032.exe File created C:\Program Files (x86)\EasyOn\EasyOn.exe 1d92358a0d53be94828b970e791ba032.exe File created C:\Program Files (x86)\EasyOn\Uninstall.exe 1d92358a0d53be94828b970e791ba032.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CLSID\ = "{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\ = "IBandHelper" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CurVer\ = "EasyOn.SideBand.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\InprocServer32\ = "C:\\Program Files (x86)\\EasyOn\\EasyOn.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\ = "IBandHelper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CLSID\ = "{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\ = "SideBand Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CurVer\ = "EasyOn.SideBand.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\TypeLib\ = "{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0\ = "EasyOn 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0\0\win32\ = "C:\\Program Files (x86)\\EasyOn\\EasyOn.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper.1\CLSID\ = "{1CE681DC-1190-40EF-85A9-ADE47098CF51}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\TypeLib\ = "{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ProgID\ = "EasyOn.SideBand.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ProgID\ = "EasyOn.SideBand.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\InprocServer32\ = "C:\\Program Files (x86)\\EasyOn\\EasyOn.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\TypeLib\ = "{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ = "ISideBand" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\EasyOn\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\ = "SideBand Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\InprocServer32\ = "C:\\Program Files (x86)\\EasyOn\\EasyOn.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper\CLSID\ = "{1CE681DC-1190-40EF-85A9-ADE47098CF51}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand.1\ = "SideBand Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand.1\CLSID\ = "{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe 560 1d92358a0d53be94828b970e791ba032.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 8 EasyOn.exe 8 EasyOn.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 560 wrote to memory of 1852 560 1d92358a0d53be94828b970e791ba032.exe 81 PID 560 wrote to memory of 1852 560 1d92358a0d53be94828b970e791ba032.exe 81 PID 560 wrote to memory of 1852 560 1d92358a0d53be94828b970e791ba032.exe 81 PID 560 wrote to memory of 8 560 1d92358a0d53be94828b970e791ba032.exe 82 PID 560 wrote to memory of 8 560 1d92358a0d53be94828b970e791ba032.exe 82 PID 560 wrote to memory of 8 560 1d92358a0d53be94828b970e791ba032.exe 82 PID 8 wrote to memory of 4728 8 EasyOn.exe 84 PID 8 wrote to memory of 4728 8 EasyOn.exe 84 PID 8 wrote to memory of 4728 8 EasyOn.exe 84 PID 560 wrote to memory of 2976 560 1d92358a0d53be94828b970e791ba032.exe 85 PID 560 wrote to memory of 2976 560 1d92358a0d53be94828b970e791ba032.exe 85 PID 560 wrote to memory of 2976 560 1d92358a0d53be94828b970e791ba032.exe 85 PID 560 wrote to memory of 2976 560 1d92358a0d53be94828b970e791ba032.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d92358a0d53be94828b970e791ba032.exe"C:\Users\Admin\AppData\Local\Temp\1d92358a0d53be94828b970e791ba032.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\EasyOn\EasyOn.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1852
-
-
C:\Program Files (x86)\EasyOn\EasyOn.exe"C:\Program Files (x86)\EasyOn\EasyOn.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\EasyOn\EasyOn.dll"3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:4728
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\system32\explorer.exe2⤵
- Deletes itself
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD54183f9464080d3aa793fcabcf275430c
SHA11f6765b478c8cd80750ea6c42fe1c568eb3e11c4
SHA256f8560197277aa28a325d83e480735ac150803f350eee7b3cfa251567ad91ea5a
SHA512cf21f04303519975ea0bd7fdf7dbe8d9afc7afc77729f398dabacbccae359ea2ad1d38446ef3610f5e5851319c0b82fc0791e210c8c60928598c3f1735dba5a6
-
Filesize
38KB
MD550745c4bd9ee3ab2897d1ea4d509c804
SHA110393255f5e1bd9050347e38305faad269c461e3
SHA256db027f86cec7f272947f7101c4db1f595e0ea65aff38139fd1fab51048177552
SHA512146e19ab69658edde1266c43ba66b7485ea19555c55b5a6241bb2049f3a1f42cdd131d5dd91ada6edabd48cf20b001f8d912db184ac43b92c0d785d037d74053
-
Filesize
114KB
MD5a3ed6f7ea493b9644125d494fbf9a1e6
SHA1ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA256ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
SHA5127099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
4KB
MD57cff7fe2caea5184d98c147e7e263132
SHA121f39d3d0dd5f7198d67ef30e95d10ae3460093e
SHA256281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101
SHA512fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a
-
Filesize
13KB
MD529858669d7da388d1e62b4fd5337af12
SHA1756b94898429a9025a04ae227f060952f1149a5f
SHA256c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
SHA5126f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
-
Filesize
4KB
MD5e3f3809f51c7982d96aaf9c090f7d176
SHA17494daa8000c0b31c58d94edc509232569a4606f
SHA256010f5e0c69b4a630b08b2551e03d8044a33350f151848dcf50953407012fab29
SHA5123fca284e384abc95201dc73f19bd9d75413e8890e819967070b9d9991115be2a8c17e07bd1aaaffcbc770b393bf9a2af253100ac4d9efba8d21110bac97737fc
-
Filesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b