Analysis
-
max time kernel
76s -
max time network
81s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-05-2021 14:10
Static task
static1
Behavioral task
behavioral1
Sample
24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe
Resource
win7v20210408
General
-
Target
24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe
-
Size
1.9MB
-
MD5
abd35d575a95891bac53ec57e8d33ccd
-
SHA1
78078d9d1c867fca632ccac4fec5bfc65230f1ab
-
SHA256
24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42
-
SHA512
6036f6ad53f5b525f7ff2f48d1924d63fcac520dcfd57bba8288317e7bdd8c75470a2f050b16483e62143ac5090a7250e56b0030e89d7279d9b1998122429bd3
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Tra.exe.comTra.exe.compid process 1356 Tra.exe.com 1996 Tra.exe.com -
Loads dropped DLL 2 IoCs
Processes:
cmd.exeTra.exe.compid process 684 cmd.exe 1356 Tra.exe.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Tra.exe.comdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Tra.exe.com Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Tra.exe.com -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exedescription pid process target process PID 332 wrote to memory of 1392 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1392 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1392 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1392 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1336 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1336 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1336 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1336 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1852 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1852 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1852 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1852 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 520 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 520 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 520 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 520 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 752 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 752 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 752 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 752 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 936 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 936 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 936 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 936 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 2044 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 2044 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 2044 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 2044 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 2028 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 2028 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 2028 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 2028 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1068 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1068 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1068 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1068 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1580 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1580 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1580 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1580 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 844 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 844 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 844 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 844 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1892 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1892 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1892 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1892 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1664 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1664 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1664 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1664 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 900 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 900 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 900 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 900 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1996 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1996 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1996 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 1996 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 860 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 860 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 860 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe PID 332 wrote to memory of 860 332 24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe"C:\Users\Admin\AppData\Local\Temp\24e43fbe7752e30765786d4b49a489ae15d0543b00cb049f13388142cb45cc42.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c xVpguGGxyc2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bpEOnapciaOcVvMCGJUMWoiuIyTpAaGvJv2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c dcQZdSoMHFAgSxtqK2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c JjfenyanqUPLaLmzciPKETNcmAiRwPvsWkZpN2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c WKGRShXWjOOnYXlZFQnTDXYBbknbPuMdGilttNqAnDgaeD2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c miWGoKTKZMtxGPAuyenRQMyVRPYxqIFmTcYfSADGMbkaZzxLYvodELZMwwOaMmKdiFAkQlhFmSyaBNWncjvDmfUicjhRLlThNUlxSoVOoDQMGGkgydXmeuQSKzPE2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vTgYRFHCBFjsIxWnoAOwZMchxlHraJmzsRMJCOPwDLDKKixLUzBSqCXJnwDGYDlSyTqQIjWxLNbhpKDhQVoYiHaOUekBlorZBKFQuErHbiihyJANbdQeckKnBjVFwcpCKbMnyMukSBBq2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tIkCbrUawEdqifUIbGeYFDIWwILpEpTKKYvEKrDsglISvnXbjDcUneUBZgAOaLNRKFdpSdXzeKJcUQAD2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c hXwOZkHrVEvDPZDvRiQoOFWFwSOamGpNWrtOLeLzIuWLBQhKuYeJJcWIqvMibgDgcIHLVOLPcvmIIlrkErjBDAtAucNffEWzCHdTpBOshhhhW2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c qPaBCxeeLVEuFAwcmRAuyqUlergVhdjRERcXXOwCsAWxfeWgd2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c OvMPpqUimmyuOxINBNyrbKPYPErmVZuZFvBQtPIxeQgCvlMBMCBppjzrGNqEXcjmayBaTRIMtKqHcjBFSBNznXQaenldOrbHEPlsIxIUTOtmjLHzkxMcHSwcfpfcHsX2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c jarGelWbSSm2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SdudQQtxswZLNOwmthhCQtjTIqdwbgDPzsCYeZEQjDJlzaTgpbzFEXTOrhIPmrWenlsckevyJvfjceAfueRqVYlvnOVPsOspHGLowneuwh2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c oHGawMaIbjWuAZVXbiGNUyuFOdsgIqKYIeeORcTeYyUXLAkpyAFZxmweBwELctqvBXnnWuywgDPPkpThtioocLEoqqhPRiHUybvOwMjZxDLQKjRaodGhVRqPadbWTdluWUJNNyjaVp2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c RqObOoUHAAxZhbGcLgfutzETQCrFetgaMtpOESINYIJFCUvduJBrFrIbcUGjyfFckwhogRRSGCivJYsVuMmzDkMJvLzJjvIJrgzAHhegRIbrVkOvDLu2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c QjSqfEMCnoGpTnzcFQgSJlBUOJNlXWuBfgTRvzkrBmPJehpbSaRMvhJFLXkGQ2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c FCwyTFECZkFlspcRRBmdaEtxteFhyniFjZTjHXzESfaGujWmlTyKuAownHqRZsvBrqXsdopUoVbrkbhSuur2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c abnMRSOqWBEBTRCygEpwKkCkeyPqxoLThloGCkAbxpX2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c dWpxViEBWwCuVhJLrNGOPLhJIWDetMHAgVUuVcyjElWjHeKgCOzGDoQEIALYDBblzwRqaCQIIzpFOwwGjfAfawXytdbxJuIeMM2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c GlKWZYLYpZlQHmyMgwiSarMVeycYBKiTepxcBzBsGrOuTmQVExzwFUmCnOTTCMvnRsNntJlVAPkffFwCfAxudygoJRXMmHPUGfgCMsQUpnAPJphSNdEwsfiMrFOjLnvTq2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c JZdmQXKmXSFnmmEtZoeNCdoCnuCDpLeHOaAgCgAGsRafuEugIGnhQh2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c aRNqJxidkQXKuZfCLHcvKXScUqgUCjORBEibOhRjlBunpUZfztNFxRrxYsuIujOYwuoBSSObQpkpRxjZqYBbmpvKBMnvioyXMibeMbbAddOlFTDEyuIiL2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c mRKnqyzsfItgvJWphCBqipxktIoUdwAXjcHGahbsiYquusvUIVTyGKp2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bnzaWmqgiuwwwdRZypToohtNkgjcocsBjsoUUyxHXMZqfcSstTZvRqo2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c zFuIjFyMPAOKiWyZPklcgtnQcUdfcVJkoZA2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ZMcaGhkOGoliNZHGPMVgifjsgQdTQDBovRqePSPqTJlhKpBv2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c rcvrjuJArtPXsXrHeLWZEQXXUxnyZHtfUFNiytlLdCMOZrC2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c kETsrwWgoFbppHflMfdhiWcwUqCqE & fOcmzeiuplOoPmFQLQeLIkymZgpRbrmVJjdJNKhjrGyynYiWvrfLXThrJVAyTfIuKTmDoWewCPHwyZwqihxxNNXQYhZSpozNYZcFmENAqgpokjXJUmXGUgaWVJEUWlRzvTruEcBDmUzm & PEMdfYJkNTJHnKQZSEQvQLapRymYxuZUSayySEGjioJqznyKKEGdDeNrjDnlnLRGTOOyEKugXDfIeaPaZOhPmJsPEwT & yvNvdeuEJZuqnaaZNywUNulKbwulbYBCRQoBPTsZkkIZHhsidsem & ZCZkeYfVWu & nDoHpRpTNwICblepJZTyWwCShpfNUwtgtXBtyKYnipLYdqBwqPFWeqObqfzZBvYMXzbAJYtZqcYMfDChIgNycijrorrPdYXKlZqWCwswLGVHe & ivNudhJSdQixsFU & JenhCfDFKHWLxPkFquWGwlHJqsJlPoJMivXTpPmRTocJdYnA & CzkJhjmxOjlGaPBXlDXSackGtMTOYzeTpGhPnrTlnmxCgkBzTLucAIjuiEFAaKcclsbMBMmiJNzSqJaSkAUjjGaAziHU & aRNrZsWOPRijZLNgzynkMfSQooDZWaxtFJdVGOwsctcIMqhVFkZepILrYXVQOXRvbeGfxRIFti & IUlroVIzKaaVXYhXJTlDbjYkJxXAODxYwRroOTMVyEutyuJsuTZLTEacVYzNYiFiXzUyUtoQugbTyUuCLFxUEItbmHhPmZXYYZuLjDbwLpFEunfwSQeaNLDffvGh & adismVuNcdioapxemdqajXIWElhvRcQXplaSnhHDohvAUlxBojQyGUExIlNgHKWZmlYiQCEjIvpZBiwzQLhEFKdfFXlhAzWndvwKjjLGHDblLFTApznVvsxPUJCTas & gmLItusiDqHWwhuDqtJtuVqwYwkPDKRhdRoKqWOxRjUVPczCNyBPIjFzmJKeUBESozGptvDtfgjUqyjDIJeboeFrjPkdjLAfHeMcOpbsBbmxZLaz & uzlmuJyOCXfkjRDOXjYaQOmjLWLDktAvRTysfQBzHHjkiugFVFenxwGsUYNlYCDnvTzzMjnu & FKpCgtFHyHFweePhNbsrdxttNOgMVTJuWNPdbPFToDSVXvxQEuZOirxlGyOmQTLjXnyghnPYRnVNBpudzboPUVZTaEKsqyefRGXmsuDydqWIoG & vYnuzKWaenjVINnXLcGWVjHZhTemTYdKMVgaCZJEVgUqylUsSelhBKNlsmSmHbnriBpMmycMLwwGsGTrYLHQNrpworwrulWnPRSEqoS & HnCAJuTKFPAWQIdtaoEctaFByDRAOfrQTUofBJawldbsJZIuBOjSDvIgTqxufzWdMKrVmqDJPClNVhRyVKYqrljvkUcAgkLRxiFZWMGAlCeqkVzFog & FxWhBbGKFErxDRazNHSpornPAikkfBQsZqubnUtB & wwViompTBFXdyeCVuMzkcxtOLxDKUVTDsTiwDIsIwaNVSwUYECsiK & UGXuvNWmYGMxYjUAancKprHoWKAEuaDMTwYBtvjEMCzipneHrrl & MZyRZOlLhsaFeZBWhzvVkQXHJmZnHSBroKZTWuCfjAsclOtpXyzKHgHVenomOLtxPfbaqHqiRuJLmCvVcQBBnRcUetRbYrAAcWFUdLpftjSBEWcmwjrYlCVYTDdVQDoOFpfD & BEKGjvkYUfuIscLZCdTqHwNxhnBttVcGSDmIzsYyJqZhljnivOrTvCfAQfzNViTYUAQOVrGlsNsGwmlqZxIdSBpdhZRtYllCuqaKvKkaoSBIlIndtaNBmDuadAAWjBjiDOmwiAEfofiZ & ByEAAZFbIeD & C:\Windows\system32\cmd < Naso.avi2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^JMwsfVERnDBURqxHDYhNCuTSPfHILUaLUPRAorBOUkHipfETBjTFiEaDSpBZhWuDkQqeoTmmbmSdnMIALOunwMEdvgIYBBAYytWzgBKINziHMeyuAwgmPHCmjKFUlAYWYUlzQfkprnLIEW$" Pensato.avi4⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tra.exe.comTra.exe.com C4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tra.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tra.exe.com C5⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CMD5
ce0e2e7cec34bdb45b1715e27ff4392a
SHA17f712fd73116ffe23e8635ab1b21bd3c913ebd16
SHA2561840e6cb99ff48323d6e6e6e7c935ac55dfd4ee37af64a7d62653cb6452ec81c
SHA512539e844c04ee015109afed8430a4e18a94b16ad7f6a6f08680e983d8a6617e411db7cd397a135f6085833d9e6a1ad2c53c1a0a69489e3aa0dcc35af33091e801
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Naso.aviMD5
6313a65137cd6d5556d34d7f39056267
SHA167e6bf4a7811c19013dfd1cfb6a951d847958e52
SHA256c76dec1dac1bce06c1f4a423ee2d209160ed88c354362cb3f2901113ac8789c9
SHA5124cb3f6b92cc738dd1708fc9e09ee91f59006ca703a61f66d1bcd1ad7e8eb8e85f59768f9df655a2350de8bb28f1fe08209f6796451726c76b77ce5d9ee0163b0
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensato.aviMD5
804d284eb436d7768f234856024a1d8e
SHA177a298187c07a1b5b3b0b4be325a8aa707c6a8c3
SHA2564f9f80eab693f9b936970b837ab5483fc0b2957361b6cd41f8169e754aca48a2
SHA5122aae472eac3d2ee5dde24cf127dc786f8c051b24ad5dc7c70c99e8658ad3cb7241e8db2268ea16e74d0d798eec19786c1042c06c2d4c1a079741f190bfba3e4a
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Piacerebbe.aviMD5
ce0e2e7cec34bdb45b1715e27ff4392a
SHA17f712fd73116ffe23e8635ab1b21bd3c913ebd16
SHA2561840e6cb99ff48323d6e6e6e7c935ac55dfd4ee37af64a7d62653cb6452ec81c
SHA512539e844c04ee015109afed8430a4e18a94b16ad7f6a6f08680e983d8a6617e411db7cd397a135f6085833d9e6a1ad2c53c1a0a69489e3aa0dcc35af33091e801
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sento.aviMD5
ed90fd784c10d5f09d290c5d72bd88e9
SHA11542c0abf6a35616088a69401a011ac0a1efd668
SHA25661443aa4846103c65c23e0267e5ebd88f9e78c29c2d1ddff02a2ce0555d66d3c
SHA512504c4436097da5e227cd9f076b2a7da48c8a48fcfaf498231894439841c4fa253cb22bc9ee257d33b6f52638010e7658dbcfc10c5d8d6da694b968ebe1fb3d3d
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tra.exe.comMD5
78ba0653a340bac5ff152b21a83626cc
SHA1b12da9cb5d024555405040e65ad89d16ae749502
SHA25605d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tra.exe.comMD5
78ba0653a340bac5ff152b21a83626cc
SHA1b12da9cb5d024555405040e65ad89d16ae749502
SHA25605d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tra.exe.comMD5
78ba0653a340bac5ff152b21a83626cc
SHA1b12da9cb5d024555405040e65ad89d16ae749502
SHA25605d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tra.exe.comMD5
78ba0653a340bac5ff152b21a83626cc
SHA1b12da9cb5d024555405040e65ad89d16ae749502
SHA25605d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tra.exe.comMD5
78ba0653a340bac5ff152b21a83626cc
SHA1b12da9cb5d024555405040e65ad89d16ae749502
SHA25605d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
-
memory/328-87-0x0000000000000000-mapping.dmp
-
memory/332-59-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/520-63-0x0000000000000000-mapping.dmp
-
memory/684-89-0x0000000000000000-mapping.dmp
-
memory/752-64-0x0000000000000000-mapping.dmp
-
memory/844-70-0x0000000000000000-mapping.dmp
-
memory/860-75-0x0000000000000000-mapping.dmp
-
memory/900-73-0x0000000000000000-mapping.dmp
-
memory/912-78-0x0000000000000000-mapping.dmp
-
memory/936-65-0x0000000000000000-mapping.dmp
-
memory/1068-68-0x0000000000000000-mapping.dmp
-
memory/1088-82-0x0000000000000000-mapping.dmp
-
memory/1112-84-0x0000000000000000-mapping.dmp
-
memory/1160-86-0x0000000000000000-mapping.dmp
-
memory/1288-76-0x0000000000000000-mapping.dmp
-
memory/1320-90-0x0000000000000000-mapping.dmp
-
memory/1336-61-0x0000000000000000-mapping.dmp
-
memory/1356-94-0x0000000000000000-mapping.dmp
-
memory/1380-83-0x0000000000000000-mapping.dmp
-
memory/1392-60-0x0000000000000000-mapping.dmp
-
memory/1572-96-0x0000000000000000-mapping.dmp
-
memory/1580-69-0x0000000000000000-mapping.dmp
-
memory/1608-77-0x0000000000000000-mapping.dmp
-
memory/1664-72-0x0000000000000000-mapping.dmp
-
memory/1760-81-0x0000000000000000-mapping.dmp
-
memory/1852-62-0x0000000000000000-mapping.dmp
-
memory/1852-79-0x0000000000000000-mapping.dmp
-
memory/1884-80-0x0000000000000000-mapping.dmp
-
memory/1892-71-0x0000000000000000-mapping.dmp
-
memory/1996-74-0x0000000000000000-mapping.dmp
-
memory/1996-101-0x0000000000000000-mapping.dmp
-
memory/1996-105-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/2008-85-0x0000000000000000-mapping.dmp
-
memory/2028-67-0x0000000000000000-mapping.dmp
-
memory/2044-66-0x0000000000000000-mapping.dmp