Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 17:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61c91ec5971cab5e0fee5fb661a8423795053296.exe
Resource
win7-20240903-en
windows7-x64
22 signatures
150 seconds
General
-
Target
61c91ec5971cab5e0fee5fb661a8423795053296.exe
-
Size
692KB
-
MD5
5c39bea66ad2ef5fb46c6056d16f8d20
-
SHA1
61c91ec5971cab5e0fee5fb661a8423795053296
-
SHA256
7479e0c0e99eade4fae849781d8db1adf9f4f5c6a680d15efa659c0a26b85516
-
SHA512
64a9c257f678d7f077fde3dad5bb56674498b2fc3730b4f5b3f804dcea5421ad265071979e5cfe3952f151ae35ae4aeabd1aaca5d114da8177b06c07e930cfb4
-
SSDEEP
12288:eqDefdyZPJZ0oqJ7EL6ssaziHfzB2r13VhcMBVDeO8lnfIgMC+:5hJpy7ELNWUZ3VuqVDeO8e
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
Loads dropped DLL 2 IoCs
pid Process 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\SD2014 = "C:\\Users\\Admin\\AppData\\Roaming\\9RhfV6L9\\9RhfV6L9.exe" 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
resource yara_rule behavioral1/memory/268-1-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-4-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-33-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-34-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-35-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-36-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-37-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-39-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-40-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-41-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-42-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-45-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-66-0x0000000000400000-0x000000000051D000-memory.dmp upx behavioral1/memory/268-67-0x0000000000400000-0x000000000051D000-memory.dmp upx -
Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2352 sc.exe 2028 sc.exe 2824 sc.exe 2628 sc.exe 2740 sc.exe 2572 sc.exe 2828 sc.exe 2036 sc.exe 2636 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61c91ec5971cab5e0fee5fb661a8423795053296.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2792 PING.EXE 1776 PING.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\don't load 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\don't load\wscui.cpl = "No" 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Extensions 61c91ec5971cab5e0fee5fb661a8423795053296.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\New Windows\PopupMgr = "no" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Security\Safety Warning Level = "SucceedSilent" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Security\Sending_Security = "Low" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Security\Trust Warning Level = "No Security" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Download 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\New Windows 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\New Windows\PopupMgr = "0" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Security 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Security\Viewing_Security = "Low" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Play_Animations = "no" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\New Windows\AllowHTTPS = "1" 61c91ec5971cab5e0fee5fb661a8423795053296.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\New Windows\PlaySound = "0" 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 856 reg.exe 2280 reg.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2792 PING.EXE 1776 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 268 wrote to memory of 2668 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 32 PID 268 wrote to memory of 2668 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 32 PID 268 wrote to memory of 2668 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 32 PID 268 wrote to memory of 2668 268 61c91ec5971cab5e0fee5fb661a8423795053296.exe 32 PID 2668 wrote to memory of 2900 2668 cmd.exe 34 PID 2668 wrote to memory of 2900 2668 cmd.exe 34 PID 2668 wrote to memory of 2900 2668 cmd.exe 34 PID 2668 wrote to memory of 2900 2668 cmd.exe 34 PID 2668 wrote to memory of 2664 2668 cmd.exe 35 PID 2668 wrote to memory of 2664 2668 cmd.exe 35 PID 2668 wrote to memory of 2664 2668 cmd.exe 35 PID 2668 wrote to memory of 2664 2668 cmd.exe 35 PID 2668 wrote to memory of 2796 2668 cmd.exe 36 PID 2668 wrote to memory of 2796 2668 cmd.exe 36 PID 2668 wrote to memory of 2796 2668 cmd.exe 36 PID 2668 wrote to memory of 2796 2668 cmd.exe 36 PID 2668 wrote to memory of 2636 2668 cmd.exe 37 PID 2668 wrote to memory of 2636 2668 cmd.exe 37 PID 2668 wrote to memory of 2636 2668 cmd.exe 37 PID 2668 wrote to memory of 2636 2668 cmd.exe 37 PID 2668 wrote to memory of 2824 2668 cmd.exe 38 PID 2668 wrote to memory of 2824 2668 cmd.exe 38 PID 2668 wrote to memory of 2824 2668 cmd.exe 38 PID 2668 wrote to memory of 2824 2668 cmd.exe 38 PID 2668 wrote to memory of 2352 2668 cmd.exe 39 PID 2668 wrote to memory of 2352 2668 cmd.exe 39 PID 2668 wrote to memory of 2352 2668 cmd.exe 39 PID 2668 wrote to memory of 2352 2668 cmd.exe 39 PID 2668 wrote to memory of 2628 2668 cmd.exe 40 PID 2668 wrote to memory of 2628 2668 cmd.exe 40 PID 2668 wrote to memory of 2628 2668 cmd.exe 40 PID 2668 wrote to memory of 2628 2668 cmd.exe 40 PID 2668 wrote to memory of 2792 2668 cmd.exe 41 PID 2668 wrote to memory of 2792 2668 cmd.exe 41 PID 2668 wrote to memory of 2792 2668 cmd.exe 41 PID 2668 wrote to memory of 2792 2668 cmd.exe 41 PID 2668 wrote to memory of 2740 2668 cmd.exe 43 PID 2668 wrote to memory of 2740 2668 cmd.exe 43 PID 2668 wrote to memory of 2740 2668 cmd.exe 43 PID 2668 wrote to memory of 2740 2668 cmd.exe 43 PID 2668 wrote to memory of 2572 2668 cmd.exe 44 PID 2668 wrote to memory of 2572 2668 cmd.exe 44 PID 2668 wrote to memory of 2572 2668 cmd.exe 44 PID 2668 wrote to memory of 2572 2668 cmd.exe 44 PID 2668 wrote to memory of 2828 2668 cmd.exe 45 PID 2668 wrote to memory of 2828 2668 cmd.exe 45 PID 2668 wrote to memory of 2828 2668 cmd.exe 45 PID 2668 wrote to memory of 2828 2668 cmd.exe 45 PID 2668 wrote to memory of 2036 2668 cmd.exe 46 PID 2668 wrote to memory of 2036 2668 cmd.exe 46 PID 2668 wrote to memory of 2036 2668 cmd.exe 46 PID 2668 wrote to memory of 2036 2668 cmd.exe 46 PID 2668 wrote to memory of 2028 2668 cmd.exe 47 PID 2668 wrote to memory of 2028 2668 cmd.exe 47 PID 2668 wrote to memory of 2028 2668 cmd.exe 47 PID 2668 wrote to memory of 2028 2668 cmd.exe 47 PID 2668 wrote to memory of 1776 2668 cmd.exe 48 PID 2668 wrote to memory of 1776 2668 cmd.exe 48 PID 2668 wrote to memory of 1776 2668 cmd.exe 48 PID 2668 wrote to memory of 1776 2668 cmd.exe 48 PID 2668 wrote to memory of 856 2668 cmd.exe 49 PID 2668 wrote to memory of 856 2668 cmd.exe 49 PID 2668 wrote to memory of 856 2668 cmd.exe 49 PID 2668 wrote to memory of 856 2668 cmd.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\61c91ec5971cab5e0fee5fb661a8423795053296.exe"C:\Users\Admin\AppData\Local\Temp\61c91ec5971cab5e0fee5fb661a8423795053296.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\9RhfV6L9\serv.bat"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v EnableVirtualization /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
PID:2664
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v RPSessionInterval /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
PID:2796
-
-
C:\Windows\SysWOW64\sc.exesc stop windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2636
-
-
C:\Windows\SysWOW64\sc.exesc stop msmpsvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2352
-
-
C:\Windows\SysWOW64\sc.exesc stop wscsvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2628
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -w 1000 -n 33⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2792
-
-
C:\Windows\SysWOW64\sc.exesc config windefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Windows\SysWOW64\sc.exesc config msmpsvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2572
-
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2828
-
-
C:\Windows\SysWOW64\sc.exesc config wscsvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2036
-
-
C:\Windows\SysWOW64\sc.exesc config luafv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2028
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -w 1000 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1776
-
-
C:\Windows\SysWOW64\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MSASCui /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:856
-
-
C:\Windows\SysWOW64\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Defender" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2280
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD5d6b3f8b8ad6b3964be094ce2f2f02539
SHA1a2033d926f6b5ad5dd5c6dc5c88b429c13449309
SHA2569580ab41a89b8233c3d3637c893e8cd7d0f658c183807576cb250a2ab70133b3
SHA512fe09769a3ef0336cb5a193619d8fffa413cfd862a82a83512b8576cd1bcf849981a775e7c9f9cee4a96a41198f76ab98a65997734beb509825ab61a977334376
-
Filesize
112B
MD5d201abad2d2dca1ccd401e4419421267
SHA1773e9bc9f8adc19db7bf4cb45e66765a2c0da0d8
SHA25685a638446470746e8b6329fa052c8e3a9e3e53ba6e800228498f524778d5fb5a
SHA51275c585d579b4cef4d0f124f2d6eb01482747a591f5ea708f53d717fc810c9c830519dc0742d26f523f4214ca791e1b5c200b45a1654f6bd044b0b4e1f9a11856
-
Filesize
692KB
MD55c39bea66ad2ef5fb46c6056d16f8d20
SHA161c91ec5971cab5e0fee5fb661a8423795053296
SHA2567479e0c0e99eade4fae849781d8db1adf9f4f5c6a680d15efa659c0a26b85516
SHA51264a9c257f678d7f077fde3dad5bb56674498b2fc3730b4f5b3f804dcea5421ad265071979e5cfe3952f151ae35ae4aeabd1aaca5d114da8177b06c07e930cfb4