Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 01:48
Behavioral task
behavioral1
Sample
cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe
Resource
win10v2004-20240802-en
General
-
Target
cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe
-
Size
232KB
-
MD5
166772cdee46493833ac6a6df1bcf7e4
-
SHA1
edba91c6fc5474a373182c02173c67b0f508b4f6
-
SHA256
cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5
-
SHA512
623911f1b2975b3eaf35493e6ad9f29150e969480bf12878853a2daae2506e19bb536bcbd6e8b299577f0c25ca539cf0f4375e34eea110974b21060fb932022a
-
SSDEEP
3072:R1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:ji/NjO5xbg/CSUFLTwMjs6oi/N+O7
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5} cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe" cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe -
resource yara_rule behavioral1/memory/2484-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0008000000016da7-10.dat upx behavioral1/files/0x0008000000016dcf-11.dat upx behavioral1/memory/2484-16-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\ie.bat cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe File created C:\WINDOWS\SysWOW64\qx.bat cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs
pid Process 2692 cmd.exe 2880 cmd.exe 2732 cmd.exe 2748 cmd.exe 2608 cmd.exe 2640 cmd.exe 2616 cmd.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\windows.exe cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe File opened for modification C:\WINDOWS\windows.exe cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe File opened for modification C:\WINDOWS\windows.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94B5D271-7304-11EF-B913-D2C9064578DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000004fb7a75a6bd2b855b2caecf6f4d923ddedc425770e75cb13a1646d3a0f13da91000000000e80000000020000200000004af9ed1a39e6a17f458b7e0e9e7b637776d6347bb85027959d1b2a1f1e5ffd97200000002a29e9d431ecd749b8fba81c64a61bb1dacdc65b01e2a2f7640a836323f32aee40000000210a0e8cc417dc0631bd299f2f36e17829c432018fa4ee43924e096f8f77cfae9e3f44bad51498bafb4a68dfb7f951a4b2abb0716050da0c765d29650d01ad36 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5021956d1107db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432526766" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000037c78879ef7df292a7473518963aa3ba21a874031e993b45e5c944a5bc354dec000000000e8000000002000020000000434d96960a63e2f5a063b232d35c372039e9def7713b24bf5c35cfacfd26571990000000dfd7fdebf34b114cd46e620ec53c62871242648037cb61529851443dc1dfb2f3ea72d5f8819ade93562bb2db2fe5a2ad8572e5a559887124c47225523a999ab86368f09f34f40520ed56fe2c3992c02222fe8063d13df1bb505f019e1766df412cdf305ce34139eb02a9cb1d31e22ef3598ddb4688e1e6b28b0764b211e46263d3abf41946aeb29d858d38ebc1c87034400000004bbbb44c41cb6c7d5649537adebcc054c20702e03d742d5acb6eba9a1189c2fd7cbdf5c5d70231d56461362d47892dc00a42f746c44823b28195ba05f73ae0d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com" cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1464 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 1464 iexplore.exe 1464 iexplore.exe 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 1464 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 30 PID 2484 wrote to memory of 1464 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 30 PID 2484 wrote to memory of 1464 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 30 PID 2484 wrote to memory of 1464 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 30 PID 1464 wrote to memory of 1972 1464 iexplore.exe 31 PID 1464 wrote to memory of 1972 1464 iexplore.exe 31 PID 1464 wrote to memory of 1972 1464 iexplore.exe 31 PID 1464 wrote to memory of 1972 1464 iexplore.exe 31 PID 2484 wrote to memory of 2692 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 32 PID 2484 wrote to memory of 2692 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 32 PID 2484 wrote to memory of 2692 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 32 PID 2484 wrote to memory of 2692 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 32 PID 2692 wrote to memory of 2800 2692 cmd.exe 34 PID 2692 wrote to memory of 2800 2692 cmd.exe 34 PID 2692 wrote to memory of 2800 2692 cmd.exe 34 PID 2692 wrote to memory of 2800 2692 cmd.exe 34 PID 2484 wrote to memory of 2880 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 35 PID 2484 wrote to memory of 2880 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 35 PID 2484 wrote to memory of 2880 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 35 PID 2484 wrote to memory of 2880 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 35 PID 2880 wrote to memory of 2592 2880 cmd.exe 37 PID 2880 wrote to memory of 2592 2880 cmd.exe 37 PID 2880 wrote to memory of 2592 2880 cmd.exe 37 PID 2880 wrote to memory of 2592 2880 cmd.exe 37 PID 2484 wrote to memory of 2732 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 38 PID 2484 wrote to memory of 2732 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 38 PID 2484 wrote to memory of 2732 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 38 PID 2484 wrote to memory of 2732 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 38 PID 2732 wrote to memory of 2932 2732 cmd.exe 40 PID 2732 wrote to memory of 2932 2732 cmd.exe 40 PID 2732 wrote to memory of 2932 2732 cmd.exe 40 PID 2732 wrote to memory of 2932 2732 cmd.exe 40 PID 2484 wrote to memory of 2748 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 41 PID 2484 wrote to memory of 2748 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 41 PID 2484 wrote to memory of 2748 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 41 PID 2484 wrote to memory of 2748 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 41 PID 2748 wrote to memory of 2844 2748 cmd.exe 43 PID 2748 wrote to memory of 2844 2748 cmd.exe 43 PID 2748 wrote to memory of 2844 2748 cmd.exe 43 PID 2748 wrote to memory of 2844 2748 cmd.exe 43 PID 2484 wrote to memory of 2608 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 44 PID 2484 wrote to memory of 2608 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 44 PID 2484 wrote to memory of 2608 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 44 PID 2484 wrote to memory of 2608 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 44 PID 2608 wrote to memory of 2760 2608 cmd.exe 46 PID 2608 wrote to memory of 2760 2608 cmd.exe 46 PID 2608 wrote to memory of 2760 2608 cmd.exe 46 PID 2608 wrote to memory of 2760 2608 cmd.exe 46 PID 2484 wrote to memory of 2640 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 47 PID 2484 wrote to memory of 2640 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 47 PID 2484 wrote to memory of 2640 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 47 PID 2484 wrote to memory of 2640 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 47 PID 2640 wrote to memory of 2596 2640 cmd.exe 49 PID 2640 wrote to memory of 2596 2640 cmd.exe 49 PID 2640 wrote to memory of 2596 2640 cmd.exe 49 PID 2640 wrote to memory of 2596 2640 cmd.exe 49 PID 2484 wrote to memory of 2616 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 50 PID 2484 wrote to memory of 2616 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 50 PID 2484 wrote to memory of 2616 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 50 PID 2484 wrote to memory of 2616 2484 cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe 50 PID 2616 wrote to memory of 2708 2616 cmd.exe 52 PID 2616 wrote to memory of 2708 2616 cmd.exe 52 PID 2616 wrote to memory of 2708 2616 cmd.exe 52 PID 2616 wrote to memory of 2708 2616 cmd.exe 52 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 2708 attrib.exe 2800 attrib.exe 2592 attrib.exe 2932 attrib.exe 2844 attrib.exe 2760 attrib.exe 2596 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe"C:\Users\Admin\AppData\Local\Temp\cf30a65b6be9b46075d3736d9214ffa593aa92ae9fbf9048c57bbc43820abba5.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2800
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2592
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2932
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2844
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2760
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\WINDOWS\windows.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2596
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\attrib.exeattrib +h "c:\system.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2708
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e912f3b895738b846d53a9b78637829d
SHA16645f1ee952f0267e726772e880bee5c5cd68d6b
SHA2568a2bdbc85f6ca3219261dc82b9d98749de11433d2c7c3b29790f6b9cb77a2056
SHA512a2106ca2291849951b5410bbd8b014d0337957cb481e05520c7d7f02f3e543a04f8629794e4d4335d8fd6efc826db589d9180c50367382bd6ea668465cfd58dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9fed8f07a09680454e5aa9b594a969a
SHA156047392e2355502911f489c60b0ae4428f2dc60
SHA2567cb0adfefcac782a8e0c3c6f3704a372d1906d2a34d3babdfdd3a38ef5e54b81
SHA512e2428d809a1584079fea16204210debca62bce23ca1846afc71247159bc2c7cf81d704b50fd99b095363eed4e32fc62bb0290ac9a8f6056eb6de156faba0b07a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d890468f58d94937f778c220caa4610
SHA1e9ffc5fce6e69d4c59f90b1b4efcfb6f97a5144e
SHA25618d98704aed99dfe11d8b995d8affa04f653657019189df306c61d8b904b60fb
SHA512dd0202fc09830c73998cf70e48667f2e9fdfccaa491f778ecf7fc05beeee5aef3bcc02aefd8ac0934f779d026ac8147fadf442f3d2b167c2122efbd85f148b5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a5372f0ea8153ce67be6067a0d86224
SHA101638ad1deca020338cb99cb888ea314fcb573b5
SHA256fdacd8e383d70c544d5b25bcd42b435e6470d8f67d828d54ab4f8d545e514191
SHA5122398fad0ea86a2ccfa53c2f4e392943a46ad6fb6533c848f733ecda8c4707c7b08c66778d6c0bd48eba189542b6cf239b2da19e00395da0b1a5b858b85f64aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53831865d52221028266673d11c08a762
SHA123d65e021ade3ed6b9ccd1a6d5341bff39273a84
SHA2560e927f846b7b03ac2f0d4db539751c88c4a452d4dfa003c04db72e47f296ad57
SHA512c91d7a17e3c7d74c7a0eb3aae2cebea2e1da680f7cc08709887f620039ff4b87c01075666e356329c56f9d1e06fa6bd8fc5705acd426a1df5dd992b6c5a0f288
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7a3fd07aac317f0ec6a4d86791aa801
SHA1905ff313e89b599712032d978deba00c90d4f383
SHA2563bc4c6b1e235b696f7053b7863944ae633b27e14415d878008b6f1cee47697d3
SHA5122e26cb9010533b144c71ae4163463a29aa3b5b41b0abd628e46a4f0e339f43ae87ed06d13d37d5f491a6c99e8cc7fe97f06116692e0bad7ca833ebd569dc7ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df54c0e8772c6d451244aee34c5703a4
SHA1c93a8f7e454445aa039759baea8b50b2c6542902
SHA25638a32049d18243b80421ac53dae9df6350fb546c4841441acb86402a8e1182c9
SHA512fabcd7a8e96e105680a2de4b982c2d474c4c738bcfa79216a4bf8da7a27d79a882251331c4a2d476315b19704140a5638d4bf83d6a3fd9be4d7da7153c1b97a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b57d5f3645963ae9c5004e97b367760
SHA19b22c65af6a1727219eaed08031436a3ad8e24dd
SHA256f4983f07d6bd2f733dd4df29c562dd4f2a5b19c63eb6a112af35ac01360ccef6
SHA5121c86feaf1f6f448434252561d189b21badb242e5cb700f9856b951a191856e1880e19573ac37a45ce2170ce53ad682e92936df12c1980dfa8fe89cccb6e4d105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9e9397956c14a6f61b747e35ed0aae3
SHA1fb518918e9763efe0b96483044639db961ffcd0e
SHA2567cee8c105e7d9757567c46aa45849ac0da6fd2040faf3476e6f21cc8d3b1afed
SHA512d3f0575c0796470fdc8c44df7991b350483e747d6fcf32bf36d170eff78a83d3fb12cacad786a992628c2c0f60fd0b91e4e96defc7e4efb23b043058fabdb64f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed4651ca1f375c0ea53b0a1cd481d3a9
SHA10124f7a31b99ddef62aba2d6386eb75f014749f8
SHA256a2f134e8a5a63f2e233fab792e19eb04a599a32a6f3979113600c2dd64ea63b8
SHA5127cc99195288749bae403f6de62affff2aafcbeadf5f193c96899d15648d3d6d3c3dfc215b91101e56622769e3c94a266d7f6899d561e7e86154f144ff6e190b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d98c08754b2ed4b4f83b22b9d28bbd8
SHA1a4809f492d346789240deff62d92336e149338b5
SHA25605d4b3d552394c3e736089d237cc2f0b876508861e3bb699fe7a37594ea6c136
SHA512399bf1573a10cb22abe5cfb01a30f56d14ffa5c5b2dcd7fae9fb1b0f17f8228f14c335479df6012ad88aeb4f694ce57fbf913f66809a212d82b0d8d236d5083b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d72af061d37a5eadc3aa08245c5e526
SHA10be621a4bec03b8eb9b50c2e21793aa34e4f6bf2
SHA25619aace1695493a19609bb618ea0b987674ccee41d29a38274f84ed82761e80d1
SHA5126d0e813637a9009f0d77c6e7b292c0d7cf2492a6f6a0928920858ffed54399f5c81cef009832338edb77858c0c7b2983e3454b2138640f3bdaa65412c270cb28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519ba43d3dbe94a827f1ef98aa7bcbf8e
SHA15f591ae5b61f3c1c54c618f180646eb54c28e9e6
SHA2562edd5b760353c112d79941071c669b53068491301909d61b9329ad069483f932
SHA5127733185e2b8cfa1d46e6e13ff5e92fe37130509fadd92d21ff361c8fc0402c7040a3c28eaa81475e4f77ec2a3efbccc882a9c807e9a3fe43028b11c3dc0f55dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5920c6d100415911da8bfed83aa0e38b1
SHA1ea716802c3da8513587aebe15e3c4f1f2225fe31
SHA2565c396eeee82f85910d4e686806a3cdf19bc92f2e5e0ea850ac84c78fc0aeb08c
SHA5128bac041b7338ff949dce3ba0b66d91628309e20b5c0906c6e60f4c6c6b0b11c8b84e28967b34c27ac07fd608516e5c41d02fbdb44f4b1244a4cb0901117b286e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540c13c74f70384d494ca8c46329ae726
SHA1067ea95b7e523d4a6ffdcca77f4af3de02e4dd33
SHA256ac4cd2f921ff9a2938001a267cec9ccf37cecca7c5077596392c7fe8a64a67ed
SHA512d7febf269a62f5deda3da939e35c611c00c3ea1a70e9e1aa83db5d89ae53934be9bf2b135a14318c94c7ae397379ab0cb3bf5ee1b1f9cddb46698456a87afd2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57783e494975623e50a3c882361379f6e
SHA16892a03fcd1f9bbab29fcffc9f998942a8979d14
SHA256ff075d9334a03691d95203bc985fc0a7d14b7324f421eaa0476aa946eaa1a71e
SHA51242c9271a8ce89fdc130fa2d60856d29cbef15300a980c46f91c4e229d26e7765942622eb6358465a45eabf932773652e806d6a6acf67885679a8cdc5b17ea754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51655f033d25b1030aeb8733cefa512df
SHA1af8f6b1e2d5113756a5c3d59389498bd2379293f
SHA256e98b5d9820c82e561ee4ddfe1ecd00160070b32015ce196bbfbbcc32be826e97
SHA5122a3e9ed37ee2bd0042b40771cae83c7e4d7b1b6b5cc5c00396d68b13bf552aeef5a5a624135b4c42f3fabdc1eea0a756c751074b2af8640bcdefcb8186415095
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ce305f44c4096cdef3c8c90a41be410
SHA1e88f4b6a49c3e0c804329e1d1a7e7177119d508f
SHA256e652ad5ea0a47dc2b37b77edfe984d97cf683815effdc4509ee9fb456d8fe1f9
SHA512cd5abf8941f9d01984bb0ea516f19d269b6f838b2d95654f49a61743ad8cbb8d6038cb6d77426281c22d4fed04ebfdfe9adeaca8d02cb6831af196a69f77c84f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b327fd36034d1229878bf0781e8b32ff
SHA1ede326097a52a8f50f0dfe4f3ccf49c1f7a58e6d
SHA256906d1e4a5b7c7645119a8a65014ed9fd6accf0ca5e111153414b3d11925db790
SHA5121bb76c6077e9fb03770869ba6c9b06ce96c6df9f909e1ddcdc254e65bd62a1494aaca7f72cfdde114d179616192f160f06a9e46fe73dd2b3442e26a019690209
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
232KB
MD57dfd691fbca6246510775a7223554df3
SHA113944bf4061c3fa7aa612afd146cbe2c30369b31
SHA2560d9a28a67106741e0bd40c3959ef493b3c90a79c067a02861f661ee7ab7e44f7
SHA512d80ceac805bd3c6cf8591a9640402aa80dc521e1602a3ed9bb01e6e2d029e4a67699b1df5ad423b86ddec71ed167343c6a7b62afec56cd4c6b918a6d934dcfce
-
Filesize
232KB
MD58f00a473446cfdee2da94f4cd68b8117
SHA15621c649cea8327e066062379d47eb00e05a68a8
SHA2569950b49dce365c2e80980affdd35f81167c7b104b25664febb07a09a405f2d3f
SHA51227b4685a478296984a0f47bf9077848e53eb17b984213576308e5719cb9257462a8eaba4d17307871b98c5601ac788968c9fab1f6f90f49b5d0059856874f9d5