Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
238s -
max time network
223s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
Zxooek.exe
Resource
win7-20240708-en
General
-
Target
Zxooek.exe
-
Size
2.5MB
-
MD5
232b1abbe3ed2387bd727d08716e0846
-
SHA1
d1706a34eed5f8b482655dede78113b5adb04db2
-
SHA256
5a11fb6ef4be30e7c7a65a256f659fab6b0833f4d32c4922f6fa36b663eb8bb3
-
SHA512
6205cd30eed573c1dd563adc87be51c21bc14eba36e5ab1e756f715a77e33edf2e97b7884a8b7d2d5c02502495f7dc4b15562237058490d0934aa2b5c985c677
-
SSDEEP
24576:fPNAyYA6foBNp0kdJV4Eac5h+sXDluxEkTj3v6OVOGH+kDs6+5iQc1RZLszJt74x:fP4ApBz4Eh+szkCkTj3vVnekLBGJt0V
Malware Config
Extracted
formbook
4.1
e62s
ellinksa.shop
uckyspinph.xyz
owdark.net
arriage-therapy-72241.bond
w7ijko4rv4p97b.top
heirbuzzwords.buzz
aspart.shop
ctivemail5-kagoya-com.info
shacertification9.shop
zitcd65k3.buzz
llkosoi.info
ru8.info
rhgtrdjdjykyetrdjftd.buzz
yschoollist.kiwi
oftfolio.online
rograma-de-almacen-2.online
oudoarms.top
mwquas.xyz
orjagaucha.website
nlinechat-mh.online
nlinebankingrates.net
3llyb.vip
42du394dr.autos
ahealthcaretrends2.bond
gbox.net
anatanwater.net
amearcade.shop
ighrane.online
01599.xyz
ams.zone
-mart.vip
42bet.xyz
6snf.shop
nitycacao.shop
arageflooringepoxynearme1.today
c7qkaihvsc.top
amingacor.click
airosstudio.tech
iktokonline.pro
homasotooleboxing.net
ashforhouse24.online
1539.app
atangtoto4.click
ndex.autos
atorengineered.tech
angkalantogel.company
ajudepo777.top
jacksontimepiece.net
gstudio-ai.homes
unter-saaaa.buzz
atageneral.sbs
ingston-saaab.buzz
i5t3.christmas
ampanyaak.click
dneshima.today
angbaojia.top
ubuz.net
pp-games-delearglu.xyz
insgw.bond
7f243xb.skin
roliig.top
wdie3162.vip
reechagroup.vip
op-phone-deal.today
orsaperevod.online
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 556 created 3500 556 Zxooek.exe 56 PID 2776 created 3500 2776 Zgrgdhtdkny.exe 56 -
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/1404-1093-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1404-1097-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
pid Process 2776 Zgrgdhtdkny.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zgrgdhtdkny = "C:\\Users\\Admin\\AppData\\Roaming\\Zgrgdhtdkny.exe" Zxooek.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 556 set thread context of 1404 556 Zxooek.exe 83 PID 1404 set thread context of 3500 1404 InstallUtil.exe 56 PID 4804 set thread context of 3500 4804 ipconfig.exe 56 PID 2776 set thread context of 2668 2776 Zgrgdhtdkny.exe 102 PID 2668 set thread context of 3500 2668 InstallUtil.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zgrgdhtdkny.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zxooek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4804 ipconfig.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Explorer.EXE -
Modifies registry class 55 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5a003100000000004459ee3c100053797374656d33320000420009000400efbe874f77484459ee3c2e000000b90c0000000001000000000000000000000000000000678e0b01530079007300740065006d0033003200000018000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).y = "4294967295" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "904" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c0043465346160031000000000002597a63120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe02597a634459ee3c2e0000007be10100000001000000000000000000000000000000f77654004100700070004400610074006100000042000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).x = "4294967295" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).bottom = "650" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).y = "4294967295" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "50" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 560031000000000002599166100057696e646f777300400009000400efbe874f77484459f33c2e0000000006000000000100000000000000000000000000000058816900570069006e0064006f0077007300000016000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000014f5964d7e4da012c1d86afe0e4da0191790eea3016db0114000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 56003100000000004459f13c1000526f616d696e6700400009000400efbe02597a634459413d2e0000007ce10100000001000000000000000000000000000000375dbd0052006f0061006d0069006e006700000016000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).x = "4294967295" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "104" Explorer.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3500 Explorer.EXE 3500 Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 556 Zxooek.exe 556 Zxooek.exe 556 Zxooek.exe 556 Zxooek.exe 1404 InstallUtil.exe 1404 InstallUtil.exe 1404 InstallUtil.exe 1404 InstallUtil.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 4804 ipconfig.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 4804 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3500 Explorer.EXE 3696 taskmgr.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1404 InstallUtil.exe 1404 InstallUtil.exe 1404 InstallUtil.exe 4804 ipconfig.exe 4804 ipconfig.exe 2668 InstallUtil.exe 2668 InstallUtil.exe 2668 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 556 Zxooek.exe Token: SeDebugPrivilege 556 Zxooek.exe Token: SeDebugPrivilege 1404 InstallUtil.exe Token: SeDebugPrivilege 4804 ipconfig.exe Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeDebugPrivilege 3696 taskmgr.exe Token: SeSystemProfilePrivilege 3696 taskmgr.exe Token: SeCreateGlobalPrivilege 3696 taskmgr.exe Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeDebugPrivilege 2776 Zgrgdhtdkny.exe Token: SeDebugPrivilege 2776 Zgrgdhtdkny.exe Token: SeDebugPrivilege 2668 InstallUtil.exe Token: SeDebugPrivilege 4956 rundll32.exe Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3500 Explorer.EXE 3500 Explorer.EXE 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe 3696 taskmgr.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE 3500 Explorer.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 556 wrote to memory of 1404 556 Zxooek.exe 83 PID 556 wrote to memory of 1404 556 Zxooek.exe 83 PID 556 wrote to memory of 1404 556 Zxooek.exe 83 PID 556 wrote to memory of 1404 556 Zxooek.exe 83 PID 556 wrote to memory of 1404 556 Zxooek.exe 83 PID 556 wrote to memory of 1404 556 Zxooek.exe 83 PID 3500 wrote to memory of 4804 3500 Explorer.EXE 84 PID 3500 wrote to memory of 4804 3500 Explorer.EXE 84 PID 3500 wrote to memory of 4804 3500 Explorer.EXE 84 PID 4804 wrote to memory of 3544 4804 ipconfig.exe 88 PID 4804 wrote to memory of 3544 4804 ipconfig.exe 88 PID 4804 wrote to memory of 3544 4804 ipconfig.exe 88 PID 3500 wrote to memory of 3696 3500 Explorer.EXE 96 PID 3500 wrote to memory of 3696 3500 Explorer.EXE 96 PID 3500 wrote to memory of 1500 3500 Explorer.EXE 98 PID 3500 wrote to memory of 1500 3500 Explorer.EXE 98 PID 3500 wrote to memory of 2776 3500 Explorer.EXE 100 PID 3500 wrote to memory of 2776 3500 Explorer.EXE 100 PID 3500 wrote to memory of 2776 3500 Explorer.EXE 100 PID 2776 wrote to memory of 2668 2776 Zgrgdhtdkny.exe 102 PID 2776 wrote to memory of 2668 2776 Zgrgdhtdkny.exe 102 PID 2776 wrote to memory of 2668 2776 Zgrgdhtdkny.exe 102 PID 2776 wrote to memory of 2668 2776 Zgrgdhtdkny.exe 102 PID 2776 wrote to memory of 2668 2776 Zgrgdhtdkny.exe 102 PID 2776 wrote to memory of 2668 2776 Zgrgdhtdkny.exe 102 PID 3500 wrote to memory of 4956 3500 Explorer.EXE 103 PID 3500 wrote to memory of 4956 3500 Explorer.EXE 103 PID 3500 wrote to memory of 4956 3500 Explorer.EXE 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\Zxooek.exe"C:\Users\Admin\AppData\Local\Temp\Zxooek.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3544
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3696
-
-
C:\Windows\System32\lcv0ji.exe"C:\Windows\System32\lcv0ji.exe"2⤵PID:1500
-
-
C:\Users\Admin\AppData\Roaming\Zgrgdhtdkny.exe"C:\Users\Admin\AppData\Roaming\Zgrgdhtdkny.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5232b1abbe3ed2387bd727d08716e0846
SHA1d1706a34eed5f8b482655dede78113b5adb04db2
SHA2565a11fb6ef4be30e7c7a65a256f659fab6b0833f4d32c4922f6fa36b663eb8bb3
SHA5126205cd30eed573c1dd563adc87be51c21bc14eba36e5ab1e756f715a77e33edf2e97b7884a8b7d2d5c02502495f7dc4b15562237058490d0934aa2b5c985c677