Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

setup_x86_...0).exe

windows7_x64

setup_x86_...0).exe

windows10_x64

10

setup_x86_...1).exe

windows7_x64

10

setup_x86_...1).exe

windows10_x64

setup_x86_...2).exe

windows7_x64

setup_x86_...2).exe

windows10_x64

setup_x86_...3).exe

windows7_x64

setup_x86_...3).exe

windows10_x64

10

setup_x86_...4).exe

windows7_x64

setup_x86_...4).exe

windows10_x64

10

setup_x86_...5).exe

windows7_x64

setup_x86_...5).exe

windows10_x64

10

setup_x86_...6).exe

windows7_x64

setup_x86_...6).exe

windows10_x64

setup_x86_...7).exe

windows7_x64

setup_x86_...7).exe

windows10_x64

setup_x86_...8).exe

windows7_x64

setup_x86_...8).exe

windows10_x64

setup_x86_...9).exe

windows7_x64

setup_x86_...9).exe

windows10_x64

10

setup_x86_...2).exe

windows7_x64

setup_x86_...2).exe

windows10_x64

10

setup_x86_...0).exe

windows7_x64

setup_x86_...0).exe

windows10_x64

10

setup_x86_...1).exe

windows7_x64

setup_x86_...1).exe

windows10_x64

10

setup_x86_...2).exe

windows7_x64

8

setup_x86_...2).exe

windows10_x64

setup_x86_...3).exe

windows7_x64

setup_x86_...3).exe

windows10_x64

10

setup_x86_...3).exe

windows7_x64

setup_x86_...3).exe

windows10_x64

Resubmissions

11/07/2024, 05:43

240711-gej4lstgrf 10

06/09/2021, 14:13

210906-rjpvrsedbm 10

08/07/2021, 11:08

210708-4gztl3mwl6 10

08/07/2021, 08:02

210708-klfb4qeda6 10

07/07/2021, 09:39

210707-nem57xyvf2 10

06/07/2021, 17:51

210706-7pcrmjy3fa 10

06/07/2021, 13:45

210706-eybelwcq86 10

Analysis

  • max time kernel
    200s
  • max time network
    272s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    28/06/2021, 15:40

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Remote task has failed: Machine shutdown
Report Analysis Logs

General

  • Target

    setup_x86_x64_install - копия (17).exe

  • Size

    3.2MB

  • MD5

    3ae1c212119919e5fce71247286f8e0e

  • SHA1

    97c1890ab73c539056f95eafede319df774e9d38

  • SHA256

    30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

  • SHA512

    5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

Score
10/10
gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojanupx

Malware Config

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 6 IoCs
    stealer
  • ASPack v2.12-2.42 14 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 43 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 15 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 18 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:852
  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2824
    • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (17).exe
      "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (17).exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1388
        • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\setup_install.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:576
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c arnatic_1.exe
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1964
            • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_1.exe
              arnatic_1.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:772
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 980
                6⤵
                • Program crash
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:2544
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c arnatic_2.exe
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:568
            • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_2.exe
              arnatic_2.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:824
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c arnatic_3.exe
            4⤵
              PID:1056
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_4.exe
              4⤵
              • Loads dropped DLL
              PID:2028
              • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_4.exe
                arnatic_4.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1352
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:932
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2188
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_5.exe
              4⤵
              • Loads dropped DLL
              PID:1300
              • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_5.exe
                arnatic_5.exe
                5⤵
                • Executes dropped EXE
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                PID:2012
                • C:\Users\Admin\AppData\Roaming\1045674.exe
                  "C:\Users\Admin\AppData\Roaming\1045674.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system certificate store
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1052
                • C:\Users\Admin\AppData\Roaming\7797243.exe
                  "C:\Users\Admin\AppData\Roaming\7797243.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1372
                • C:\Users\Admin\AppData\Roaming\2694099.exe
                  "C:\Users\Admin\AppData\Roaming\2694099.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  PID:1548
                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1640
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_7.exe
              4⤵
              • Loads dropped DLL
              PID:1752
              • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_7.exe
                arnatic_7.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:1996
                • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_7.exe
                  C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_7.exe
                  6⤵
                  • Executes dropped EXE
                  PID:1580
                • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_7.exe
                  C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_7.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1324
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_6.exe
              4⤵
              • Loads dropped DLL
              PID:1688
      • C:\Users\Admin\AppData\Local\Temp\7zSC65AEE25\arnatic_6.exe
        arnatic_6.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        PID:1992
        • C:\Users\Admin\Documents\nz3L7k_WqQfWrNaYqorqmf3M.exe
          "C:\Users\Admin\Documents\nz3L7k_WqQfWrNaYqorqmf3M.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          PID:1956
          • C:\Users\Admin\Documents\nz3L7k_WqQfWrNaYqorqmf3M.exe
            "C:\Users\Admin\Documents\nz3L7k_WqQfWrNaYqorqmf3M.exe"
            3⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: MapViewOfSection
            PID:3048
        • C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe
          "C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:756
          • C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe
            "C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe"
            3⤵
            • Executes dropped EXE
            PID:2728
          • C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe
            "C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe"
            3⤵
            • Executes dropped EXE
            PID:2736
          • C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe
            "C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe"
            3⤵
            • Executes dropped EXE
            PID:2380
          • C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe
            "C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe"
            3⤵
            • Executes dropped EXE
            PID:2192
          • C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe
            "C:\Users\Admin\Documents\hGa2n6nTtpsgCnD8GKHTTNWM.exe"
            3⤵
            • Executes dropped EXE
            PID:2752
        • C:\Users\Admin\Documents\TYmCKMAD1ZFaanMnluADxkNT.exe
          "C:\Users\Admin\Documents\TYmCKMAD1ZFaanMnluADxkNT.exe"
          2⤵
          • Executes dropped EXE
          • Checks BIOS information in registry
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:912
        • C:\Users\Admin\Documents\xq034mons1tgJPLphcrXezQk.exe
          "C:\Users\Admin\Documents\xq034mons1tgJPLphcrXezQk.exe"
          2⤵
          • Executes dropped EXE
          PID:1896
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 968
            3⤵
            • Program crash
            PID:2416
        • C:\Users\Admin\Documents\XSihv2czs8o7eKZDRsNKaU7E.exe
          "C:\Users\Admin\Documents\XSihv2czs8o7eKZDRsNKaU7E.exe"
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2096
          • C:\Program Files (x86)\Company\NewProduct\file4.exe
            "C:\Program Files (x86)\Company\NewProduct\file4.exe"
            3⤵
            • Executes dropped EXE
            PID:2248
          • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
            "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
            3⤵
            • Executes dropped EXE
            PID:2276
            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2596
            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
              4⤵
              • Executes dropped EXE
              PID:3060
          • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
            "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
            3⤵
            • Executes dropped EXE
            PID:2336
            • C:\Windows\SysWOW64\rUNdlL32.eXe
              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
              4⤵
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:2688
          • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
            "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
            3⤵
            • Executes dropped EXE
            PID:2348
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 292
              4⤵
              • Program crash
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2464
        • C:\Users\Admin\Documents\ucLDoBLgLI9xGVrLdqkwvhO2.exe
          "C:\Users\Admin\Documents\ucLDoBLgLI9xGVrLdqkwvhO2.exe"
          2⤵
          • Executes dropped EXE
          PID:2084
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 972
            3⤵
            • Program crash
            PID:2564
        • C:\Users\Admin\Documents\lrWMBiSZHEUkSFfRDOn6WVPj.exe
          "C:\Users\Admin\Documents\lrWMBiSZHEUkSFfRDOn6WVPj.exe"
          2⤵
          • Executes dropped EXE
          • Modifies system certificate store
          PID:2072
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2376
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            PID:2968
        • C:\Users\Admin\Documents\M7kxfV8QGqdikxGgNPATdQA5.exe
          "C:\Users\Admin\Documents\M7kxfV8QGqdikxGgNPATdQA5.exe"
          2⤵
          • Executes dropped EXE
          PID:2144
          • C:\Users\Admin\Documents\M7kxfV8QGqdikxGgNPATdQA5.exe
            "C:\Users\Admin\Documents\M7kxfV8QGqdikxGgNPATdQA5.exe"
            3⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            PID:1528
        • C:\Users\Admin\Documents\AmFdeiYB5lDtAodwc6w5PAMc.exe
          "C:\Users\Admin\Documents\AmFdeiYB5lDtAodwc6w5PAMc.exe"
          2⤵
          • Executes dropped EXE
          PID:2216
          • C:\Windows\SysWOW64\rUNdlL32.eXe
            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
            3⤵
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:2708
      • C:\Users\Admin\AppData\Local\Temp\CFC.exe
        C:\Users\Admin\AppData\Local\Temp\CFC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:880
        • C:\Users\Admin\AppData\Local\Temp\CFC.exe
          C:\Users\Admin\AppData\Local\Temp\CFC.exe
          2⤵
          • Executes dropped EXE
          PID:1312
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\AppData\Local\0949658f-d1ed-4818-a182-4cb5131de3eb" /deny *S-1-1-0:(OI)(CI)(DE,DC)
            3⤵
            • Modifies file permissions
            PID:2964
          • C:\Users\Admin\AppData\Local\Temp\CFC.exe
            "C:\Users\Admin\AppData\Local\Temp\CFC.exe" --Admin IsNotAutoStart IsNotTask
            3⤵
              PID:1468
        • C:\Users\Admin\AppData\Local\Temp\17B6.exe
          C:\Users\Admin\AppData\Local\Temp\17B6.exe
          1⤵
          • Executes dropped EXE
          PID:844
        • C:\Users\Admin\AppData\Local\Temp\2CFC.exe
          C:\Users\Admin\AppData\Local\Temp\2CFC.exe
          1⤵
            PID:2068

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/576-109-0x000000006FE40000-0x000000006FFC6000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/576-105-0x000000006B440000-0x000000006B4CF000-memory.dmp

            Filesize

            572KB

            Download

          • memory/576-94-0x0000000064940000-0x0000000064959000-memory.dmp

            Filesize

            100KB

            Download

          • memory/576-91-0x0000000064940000-0x0000000064959000-memory.dmp

            Filesize

            100KB

            Download

          • memory/576-93-0x0000000000400000-0x000000000051E000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/576-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

            Filesize

            152KB

            Download

          • memory/576-117-0x000000006B280000-0x000000006B2A6000-memory.dmp

            Filesize

            152KB

            Download

          • memory/576-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/576-103-0x0000000064940000-0x0000000064959000-memory.dmp

            Filesize

            100KB

            Download

          • memory/576-102-0x0000000064940000-0x0000000064959000-memory.dmp

            Filesize

            100KB

            Download

          • memory/576-92-0x0000000000400000-0x000000000051E000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/576-88-0x000000006B440000-0x000000006B4CF000-memory.dmp

            Filesize

            572KB

            Download

          • memory/756-217-0x0000000000330000-0x0000000000331000-memory.dmp

            Filesize

            4KB

            Download

          • memory/756-223-0x00000000007A0000-0x00000000007A1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/772-200-0x0000000000400000-0x0000000000949000-memory.dmp

            Filesize

            5.3MB

            Download

          • memory/772-198-0x0000000000D50000-0x0000000000DED000-memory.dmp

            Filesize

            628KB

            Download

          • memory/824-194-0x0000000000240000-0x0000000000249000-memory.dmp

            Filesize

            36KB

            Download

          • memory/824-197-0x0000000000400000-0x00000000008F4000-memory.dmp

            Filesize

            5.0MB

            Download

          • memory/844-291-0x0000000000220000-0x000000000024F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/844-293-0x0000000004862000-0x0000000004863000-memory.dmp

            Filesize

            4KB

            Download

          • memory/844-292-0x0000000000400000-0x00000000004E9000-memory.dmp

            Filesize

            932KB

            Download

          • memory/844-296-0x0000000004864000-0x0000000004866000-memory.dmp

            Filesize

            8KB

            Download

          • memory/844-295-0x0000000004863000-0x0000000004864000-memory.dmp

            Filesize

            4KB

            Download

          • memory/844-294-0x0000000004861000-0x0000000004862000-memory.dmp

            Filesize

            4KB

            Download

          • memory/852-255-0x0000000000C00000-0x0000000000C70000-memory.dmp

            Filesize

            448KB

            Download

          • memory/852-254-0x0000000001580000-0x00000000015F1000-memory.dmp

            Filesize

            452KB

            Download

          • memory/852-253-0x0000000000F50000-0x0000000000F9C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/852-250-0x00000000008F0000-0x000000000093B000-memory.dmp

            Filesize

            300KB

            Download

          • memory/880-287-0x0000000001E00000-0x0000000001F1B000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/912-236-0x0000000004C00000-0x0000000004C01000-memory.dmp

            Filesize

            4KB

            Download

          • memory/912-230-0x00000000008B0000-0x00000000008B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1052-193-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1052-188-0x0000000000390000-0x0000000000391000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1052-201-0x00000000005D0000-0x00000000005D1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1052-180-0x0000000000990000-0x0000000000991000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1052-199-0x00000000003F0000-0x0000000000422000-memory.dmp

            Filesize

            200KB

            Download

          • memory/1268-203-0x0000000002B00000-0x0000000002B16000-memory.dmp

            Filesize

            88KB

            Download

          • memory/1268-273-0x0000000003B80000-0x0000000003B97000-memory.dmp

            Filesize

            92KB

            Download

          • memory/1312-288-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1324-195-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/1324-189-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/1324-206-0x0000000005120000-0x0000000005121000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1372-280-0x00000000010D0000-0x00000000010D1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1372-185-0x00000000013C0000-0x00000000013C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1548-187-0x00000000001E0000-0x00000000001E1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1548-183-0x0000000000C10000-0x0000000000C11000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1548-192-0x00000000001F0000-0x0000000000200000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1548-202-0x0000000000200000-0x0000000000201000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1640-216-0x0000000004D30000-0x0000000004D31000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1640-207-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1896-267-0x0000000001EC0000-0x0000000001F5D000-memory.dmp

            Filesize

            628KB

            Download

          • memory/1896-268-0x0000000000400000-0x000000000052D000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1956-265-0x00000000001D0000-0x00000000001DC000-memory.dmp

            Filesize

            48KB

            Download

          • memory/1996-172-0x0000000000C70000-0x0000000000C71000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2008-59-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2012-157-0x0000000000A00000-0x0000000000A01000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2012-167-0x000000001B100000-0x000000001B102000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2012-161-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2012-159-0x00000000002C0000-0x00000000002C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2012-160-0x00000000002D0000-0x00000000002EF000-memory.dmp

            Filesize

            124KB

            Download

          • memory/2068-297-0x00000000002F0000-0x000000000035B000-memory.dmp

            Filesize

            428KB

            Download

          • memory/2068-298-0x0000000000400000-0x0000000000529000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2084-270-0x0000000000400000-0x0000000000950000-memory.dmp

            Filesize

            5.3MB

            Download

          • memory/2084-269-0x0000000000950000-0x00000000009ED000-memory.dmp

            Filesize

            628KB

            Download

          • memory/2144-271-0x0000000002D20000-0x0000000003646000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/2144-272-0x0000000000400000-0x0000000000D41000-memory.dmp

            Filesize

            9.3MB

            Download

          • memory/2248-240-0x00000000002F0000-0x0000000000302000-memory.dmp

            Filesize

            72KB

            Download

          • memory/2248-238-0x0000000000270000-0x0000000000280000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2416-279-0x00000000002A0000-0x00000000002A1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2464-260-0x00000000004A0000-0x00000000004A1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2544-261-0x00000000004A0000-0x00000000004A1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2564-277-0x00000000005E0000-0x00000000005E1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2688-249-0x00000000020A0000-0x00000000021A1000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/2688-252-0x00000000008C0000-0x000000000091C000-memory.dmp

            Filesize

            368KB

            Download

          • memory/2708-251-0x0000000002010000-0x0000000002111000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/2708-256-0x0000000000390000-0x00000000003ED000-memory.dmp

            Filesize

            372KB

            Download

          • memory/2824-274-0x0000000000560000-0x000000000057B000-memory.dmp

            Filesize

            108KB

            Download

          • memory/2824-275-0x0000000002A10000-0x0000000002B16000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/2824-259-0x0000000000430000-0x00000000004A1000-memory.dmp

            Filesize

            452KB

            Download

          • memory/3048-266-0x0000000000400000-0x000000000040C000-memory.dmp

            Filesize

            48KB

            Download