Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 04:33
Behavioral task
behavioral1
Sample
f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Resource
win10v2004-20240802-en
General
-
Target
f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
-
Size
91KB
-
MD5
99583bad9b5a5a950f175e054b42d4b3
-
SHA1
0179a7e86748547d6460ec0c4b1c5e094fe7d03b
-
SHA256
f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839
-
SHA512
5394a66293cc54ee93315d09c1d7ba6b5c948a47ddd958ef773dbee25e05d3c2d35d9d41de8fa5274b0ed155bf5c1b2b48aacd72b1e966e87ca6fb694848b624
-
SSDEEP
1536:XJRtlEnBHHIgabuYotV/JbJCX5SBixJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIxvtYxOuYotvYQIE
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 13 IoCs
pid Process 2124 xk.exe 2548 IExplorer.exe 1940 WINLOGON.EXE 2644 CSRSS.EXE 1828 SERVICES.EXE 884 LSASS.EXE 2340 xk.exe 1876 IExplorer.exe 1344 WINLOGON.EXE 2440 CSRSS.EXE 1236 SERVICES.EXE 2212 LSASS.EXE 1520 SMSS.EXE -
Loads dropped DLL 22 IoCs
pid Process 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\desktop.ini f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created C:\desktop.ini f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened for modification F:\desktop.ini f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created F:\desktop.ini f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\I: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\N: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\U: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\V: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\Z: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\M: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\Q: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\S: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\W: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\P: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\R: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\X: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\E: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\K: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\L: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\O: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\T: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\B: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\G: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\H: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File opened (read-only) \??\J: f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\Mig2.scr f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\IExplorer.exe f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\shell.exe f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created C:\Windows\SysWOW64\Mig2.scr f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created C:\Windows\SysWOW64\IExplorer.exe f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\shell.exe f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE -
resource yara_rule behavioral1/memory/2112-0-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0006000000016d9c-8.dat upx behavioral1/memory/2112-106-0x0000000002680000-0x00000000026AF000-memory.dmp upx behavioral1/files/0x0007000000016fea-111.dat upx behavioral1/memory/2124-114-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018b89-115.dat upx behavioral1/memory/2548-126-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018bbf-127.dat upx behavioral1/memory/2112-140-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1940-139-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018c8e-145.dat upx behavioral1/memory/2644-148-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018cde-151.dat upx behavioral1/memory/2644-150-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1828-159-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/884-173-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/884-176-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1828-163-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018ce8-170.dat upx behavioral1/files/0x0007000000016fea-231.dat upx behavioral1/memory/1876-243-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/2340-242-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018b89-240.dat upx behavioral1/files/0x0005000000018bbf-246.dat upx behavioral1/memory/1876-254-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1344-259-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018c8e-266.dat upx behavioral1/memory/2440-269-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018cde-272.dat upx behavioral1/memory/2440-275-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1236-297-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/2212-299-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/2212-296-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/files/0x0005000000018cf2-300.dat upx behavioral1/memory/1520-310-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/2112-466-0x0000000000400000-0x000000000042F000-memory.dmp upx -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\xk.exe f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE File opened for modification C:\Windows\xk.exe f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMSS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SERVICES.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSASS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINLOGON.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUTLOOK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSASS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSRSS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SERVICES.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINLOGON.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSRSS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xk.exe -
Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\ f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E5-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F8-0000-0000-C000-000000000046}\ = "StoresEvents_12" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304E-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304D-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063094-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DB-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067355-0000-0000-C000-000000000046}\ = "_OlkSenderPhoto" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063042-0000-0000-C000-000000000046}\ = "UserProperty" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E7-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CE-0000-0000-C000-000000000046}\ = "_RuleActions" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D8-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063099-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063086-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063097-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EC-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063039-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E6-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EF-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DD-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E2-0000-0000-C000-000000000046}\ = "OlkCheckBoxEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EB-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E6-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CD-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308D-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300B-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067367-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A0-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063094-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304A-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DF-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303C-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DA-0000-0000-C000-000000000046}\ = "_ImportanceRuleCondition" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302C-0000-0000-C000-000000000046}\ = "ApplicationEvents_11" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DB-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063046-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308D-0000-0000-C000-000000000046}\ = "_Views" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E2-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CA-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063076-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300D-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EC-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\ = "_ContactItem" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303C-0000-0000-C000-000000000046}\ = "Attachments" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DE-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302B-0000-0000-C000-000000000046}\ = "ItemEvents_10" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300B-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063074-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DB-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309B-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063071-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067353-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E8-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063075-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305B-0000-0000-C000-000000000046}\ = "FormRegionEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EF-0000-0000-C000-000000000046} OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1568 OUTLOOK.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1568 OUTLOOK.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1568 OUTLOOK.EXE 1568 OUTLOOK.EXE 1568 OUTLOOK.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1568 OUTLOOK.EXE 1568 OUTLOOK.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 2124 xk.exe 2548 IExplorer.exe 1940 WINLOGON.EXE 2644 CSRSS.EXE 1828 SERVICES.EXE 884 LSASS.EXE 2340 xk.exe 1876 IExplorer.exe 1344 WINLOGON.EXE 2440 CSRSS.EXE 1236 SERVICES.EXE 2212 LSASS.EXE 1520 SMSS.EXE 1568 OUTLOOK.EXE -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2124 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 30 PID 2112 wrote to memory of 2124 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 30 PID 2112 wrote to memory of 2124 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 30 PID 2112 wrote to memory of 2124 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 30 PID 2112 wrote to memory of 2548 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 31 PID 2112 wrote to memory of 2548 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 31 PID 2112 wrote to memory of 2548 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 31 PID 2112 wrote to memory of 2548 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 31 PID 2112 wrote to memory of 1940 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 32 PID 2112 wrote to memory of 1940 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 32 PID 2112 wrote to memory of 1940 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 32 PID 2112 wrote to memory of 1940 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 32 PID 2112 wrote to memory of 2644 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 33 PID 2112 wrote to memory of 2644 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 33 PID 2112 wrote to memory of 2644 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 33 PID 2112 wrote to memory of 2644 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 33 PID 2112 wrote to memory of 1828 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 34 PID 2112 wrote to memory of 1828 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 34 PID 2112 wrote to memory of 1828 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 34 PID 2112 wrote to memory of 1828 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 34 PID 2112 wrote to memory of 884 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 35 PID 2112 wrote to memory of 884 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 35 PID 2112 wrote to memory of 884 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 35 PID 2112 wrote to memory of 884 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 35 PID 2112 wrote to memory of 2340 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 36 PID 2112 wrote to memory of 2340 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 36 PID 2112 wrote to memory of 2340 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 36 PID 2112 wrote to memory of 2340 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 36 PID 2112 wrote to memory of 1876 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 37 PID 2112 wrote to memory of 1876 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 37 PID 2112 wrote to memory of 1876 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 37 PID 2112 wrote to memory of 1876 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 37 PID 2112 wrote to memory of 1344 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 38 PID 2112 wrote to memory of 1344 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 38 PID 2112 wrote to memory of 1344 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 38 PID 2112 wrote to memory of 1344 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 38 PID 2112 wrote to memory of 2440 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 39 PID 2112 wrote to memory of 2440 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 39 PID 2112 wrote to memory of 2440 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 39 PID 2112 wrote to memory of 2440 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 39 PID 2112 wrote to memory of 1236 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 40 PID 2112 wrote to memory of 1236 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 40 PID 2112 wrote to memory of 1236 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 40 PID 2112 wrote to memory of 1236 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 40 PID 2112 wrote to memory of 2212 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 41 PID 2112 wrote to memory of 2212 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 41 PID 2112 wrote to memory of 2212 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 41 PID 2112 wrote to memory of 2212 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 41 PID 2112 wrote to memory of 1520 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 42 PID 2112 wrote to memory of 1520 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 42 PID 2112 wrote to memory of 1520 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 42 PID 2112 wrote to memory of 1520 2112 f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe 42 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe"C:\Users\Admin\AppData\Local\Temp\f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2112 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2548
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2644
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:884
-
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1876
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1344
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2440
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2212
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1568
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5c0e8b4334b8ec3d5a0d21ecf9f711cae
SHA13d159f320df89f68baabe80ad3edc2346f0e35fe
SHA2566e6abfb8ed0bd4fc3102a0eec91219f051e8630b015801f3b4c4d720abbd5bee
SHA512d57cb3597878e7a546759fff78e92792fb2b46ee4b220db4d11fd9e12a452d19728c29a130a535330bab56ae6f57d0256594fce8f799778e52b40d08680e1679
-
Filesize
235KB
MD5491765652386343328bcd4e0a30ebc2b
SHA19dbd72d4e4d61f408e8fcf0fa6b2db08198fd8ee
SHA256e719c0e9ced9e1e75045f439a8611ca48af90a7b7c03f2d8a6e75e96f47814d5
SHA512551746099f66b963be7367aa8193685860ea11b4a96fc27d6d9e2a04279213de22d4dd7c5231dcf7a92ab80ceb807d1d98a4d6ba36a51089fdcfb99cbf6c4936
-
Filesize
235KB
MD51d2fe883a23da7d9fae279c3386332dc
SHA1deb17b7ff97d5a40e44005c79507e21c21ce48e7
SHA256c70066ea39641d99e326978b5994ab37bd9b4f146c1460070e76e9708fc0edef
SHA5120fcb88ea04ad8b84384717bdcaedf5094ba47eb81a00deb683ed6775fbfb7e27b5ea7a834954ccad9fa8d17b1a1619a07cbee020e2eebe1021659519c4706843
-
Filesize
1KB
MD548dd6cae43ce26b992c35799fcd76898
SHA18e600544df0250da7d634599ce6ee50da11c0355
SHA2567bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a
SHA512c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31
-
Filesize
91KB
MD502e6e25b3671159d5692f5f3ae7a6eb2
SHA1615cdca62b009f4f80f3b23123ac32df270eb677
SHA2569a7f5a97322a91b93b4312a5b7667b3d92ee95521aabb55ff60ef97c08876c35
SHA5123b98f4a4ce04ba18b54cc1a51cb16b44fa639fa5839da063c7db826e35738a4f28b0ce02cf8a8535dde85cae802e5d1244f99d6cbb2bbf0521264926b9121579
-
Filesize
91KB
MD5c1c1f1af4b2f7910d32c1f38d347004c
SHA1d99003f741bc0a38db3a18f6c9e01b9704f76fb3
SHA25699b933488a9a0e5db0dc1fa78676f3704046e2be1b3285b3e4baca3b2c5dfecb
SHA512b8a085619f12955f207c33da2374a92173dceb7094b57f000502c6cf727e5ef26ba4a70a8f3a8c2774cb88d81c209a832ddb57a6246022baa3a2ff1719fb2c31
-
Filesize
91KB
MD5a437baea036c7bebaef2fd073f3fc670
SHA1c87a92de97feca218a99e586f081d412dc65b38f
SHA256aa1be722ff5198a64ee72da192d182a8728aba3d1f415c518af5c9eefe7c287b
SHA5122a978a8c1432cd0284778aebc32ce094329e811d3183ec01e1f0efa87a25eb6ed492fe8ae1606e5dad14a791f0b3f7ea518ff319fc076ccae2bab406ae906d48
-
Filesize
91KB
MD599583bad9b5a5a950f175e054b42d4b3
SHA10179a7e86748547d6460ec0c4b1c5e094fe7d03b
SHA256f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839
SHA5125394a66293cc54ee93315d09c1d7ba6b5c948a47ddd958ef773dbee25e05d3c2d35d9d41de8fa5274b0ed155bf5c1b2b48aacd72b1e966e87ca6fb694848b624
-
Filesize
91KB
MD560a7873a9d653e7ff243fd397f5ac88e
SHA122e5c1c3dc70efa4f6c1771b0a65306d754630a0
SHA256dfce4ac760eb42bdc1714216b34982ad46f59ec33d01954fbe2bdad71a1f274d
SHA5128d4ba42c4e8ded63856c35513f42c4e30ab4a760e8c18cfdd5d381b35e22f76af8ab332ee132889ca42f139e734bb79fa150efef5639dee927b89c65d7291d41
-
Filesize
91KB
MD5fa1bca73f422535e76d6a6e828adaa7d
SHA17a24ff67c2feadccb74c6bb3adfbe9f97ba3b733
SHA2561ebc139315332404a283ae46950b0276de0b767832b7b455438d9d8cae483c29
SHA512cf147197419761b23d671d99706b5f6f5070054cc27e321a6b759b0399fb13cd74cef9393c022308732451ed5d18090970dfb4a0a9962812cdbbad8ccc3ca26e
-
Filesize
91KB
MD5bd4a71d43b4afeb21df26a3bdca2e277
SHA1501c54eef73e469a84b20652e54fec64c0272583
SHA25668400676a74525437789b6cad888664a1124bb98526778547b710d47b05b6759
SHA512802a8ac2986dcd93c2ec2c5a8afe95100d63e9f2b9e618e6a93a176c7d2ca76d856dea51d118f2bbd8428c928de46719c81174b45af10212e8eb072218532236
-
Filesize
91KB
MD5c5eebd0c9601a36206ea9d72270cd1f8
SHA16b60a01c30548992fd84389c808078eeb71244bb
SHA25612e87690dcee7abe99b3a56b0398c53ce13d135c62670e65ba83b6b1df595043
SHA5121ad37a307db0b73a38107c58cb5b702bde6b4ed2e1e4366d1662743d95609c430cf1ab01d986f23c809c3e1632fd819bcec3de275ed0f468c8bcef328e1c83db
-
Filesize
91KB
MD55bc212ecd07c5e5b7795509fe61c3e9b
SHA1e31e03028bc9de0f4daa7e201159057ede300c5f
SHA256e6a3497a2921cbbffdc543cc5dca0ef70679fac85da5e65722aab563b09ba2ae
SHA512f4b3376b8cc8edfe1db76c31a78f10cea1ffc1e3947a494a7c4d678182eeacf70dee25bdde932dcd6f685bc1bb77d90a71f1e7efed6bdcc8055c2a14dd7de69f
-
Filesize
91KB
MD573b511b29d821e66a58abcb2d444a51d
SHA11e3f1126187ab0b39cbc3d2f80cad8d979469072
SHA256dbe80f2bc785d9ddbc112f2ab404eb382340183b62f448ae996afe7c9d8b45eb
SHA51287f6c7d90c1cbf8f9916a3ce902f4b9e639251ea6fc89b637903e2fbadd2829a8cadb28767c1ea76afe177ed8bfe9ac86a1ff93231f4c992789d96ffc458f524
-
Filesize
91KB
MD5518960c8487e3ff6621b1dbca1344fe7
SHA1436e283360d1ab2c5babf1e9f50ee318a48a0b08
SHA2569814be84fdff4043230d34687020da4e77865a8cc48cf83c2d3bba2c53acd5e9
SHA512a56f06c64501b21326400fedba54e67a8778bfb2794ec2544e045d54076b7d90721cbc52a439b55fdea7bbd23ee20641b1ae1a8c58d325d4f30246582fd0af8c
-
Filesize
91KB
MD577273a017934b0ae624961d7ccb15dda
SHA1aa6cc9c041d1ec64b81db89dac32289c018c8796
SHA256e9914aafb0acdcd104bc414000d849385605d09af2e38ff4126868aa31dc00f8
SHA512e91c96bbf6bb26bf1f2b73e8ca93dafe5c4ee8ba66e33cb92b20edfab8c8a4f67d798176080626c4a780887a1664fcab0822dd9bf1673c055f2ad47b5a631a29
-
Filesize
91KB
MD54ebf6dd5fe18f9bf43c2b831e8272306
SHA1b335301b970b8b306f91248c6156f1834d31f90e
SHA256cfcea0a36a8ff1618f329283d58ee87fdc4a789fe021a078e1606efced3f5d3a
SHA5121e16adadec15f6f336dc2d66e7ba02449286b8cfd54871d7422444f8ca827b4354f4be68cca336d57155a82381f916c64d3637a02e0a1316b60a6bf73b13d953