Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
28s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
08/11/2021, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211014
Behavioral task
behavioral10
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211104
Behavioral task
behavioral11
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral16
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211014
Behavioral task
behavioral17
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211104
Behavioral task
behavioral18
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211104
Behavioral task
behavioral20
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
-
Size
5.6MB
-
MD5
5802bc4fd763cd759b7875e94f9f2eaf
-
SHA1
91eaa6e6f9b5c52a2b91806bfbf513ed336e3f6a
-
SHA256
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2
-
SHA512
91f9c64c61456c91e74cad1c8a5f9aca54e44f00612085721c1b2ad8e9305679f3ed562939b0505843c06b619ab8f4818f3a537e33c122a02569cf080d13181a
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
media25
91.121.67.60:23325
Extracted
redline
ChrisNEW
194.104.136.5:46013
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral14/memory/4452-278-0x0000000000418542-mapping.dmp family_redline behavioral14/memory/4472-283-0x0000000000418D2E-mapping.dmp family_redline behavioral14/memory/4472-279-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral14/memory/4452-277-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral14/files/0x000400000001abec-192.dat family_socelars behavioral14/files/0x000400000001abec-212.dat family_socelars -
resource yara_rule behavioral14/files/0x000200000001abd5-123.dat aspack_v212_v242 behavioral14/files/0x000200000001abdb-130.dat aspack_v212_v242 behavioral14/files/0x000200000001abdb-129.dat aspack_v212_v242 behavioral14/files/0x000200000001abd5-127.dat aspack_v212_v242 behavioral14/files/0x000200000001abd5-125.dat aspack_v212_v242 behavioral14/files/0x000200000001abd7-124.dat aspack_v212_v242 behavioral14/files/0x000200000001abd7-122.dat aspack_v212_v242 -
Executes dropped EXE 18 IoCs
pid Process 820 setup_installer.exe 3816 setup_install.exe 1028 Tue018f791563585c0f9.exe 1724 Tue010769fc7f9829.exe 1696 Tue01994ec7a792fea9.exe 1424 Tue0133c29150b.exe 1908 Tue01d702368dbba.exe 4012 Tue01c451610f4a.exe 3040 Tue0195119235.exe 3204 Tue01e8898e0d1fce4.exe 2384 Tue017abac33187.exe 688 Tue01bf08f313b912.exe 3856 Tue018bc5c5a0a3d4.exe 2880 Tue0138d4026db6d813e.exe 1272 Tue01bba8b80fa4.exe 400 Tue0195119235.exe 1496 Tue01de2411919659f09.exe 4048 Tue01d702368dbba.tmp -
Loads dropped DLL 8 IoCs
pid Process 3816 setup_install.exe 3816 setup_install.exe 3816 setup_install.exe 3816 setup_install.exe 3816 setup_install.exe 3816 setup_install.exe 3816 setup_install.exe 3816 setup_install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 68 ip-api.com 72 ipinfo.io 73 ipinfo.io 74 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
autoit_exe 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral14/files/0x000400000001abed-161.dat autoit_exe behavioral14/files/0x000400000001abed-187.dat autoit_exe behavioral14/files/0x000500000001abfc-298.dat autoit_exe behavioral14/files/0x000500000001abfc-300.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 3548 3816 WerFault.exe 70 4512 2880 WerFault.exe 103 1308 2880 WerFault.exe 103 -
Kills process with taskkill 1 IoCs
pid Process 5084 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1724 Tue010769fc7f9829.exe Token: SeCreateTokenPrivilege 688 Tue01bf08f313b912.exe Token: SeAssignPrimaryTokenPrivilege 688 Tue01bf08f313b912.exe Token: SeLockMemoryPrivilege 688 Tue01bf08f313b912.exe Token: SeIncreaseQuotaPrivilege 688 Tue01bf08f313b912.exe Token: SeMachineAccountPrivilege 688 Tue01bf08f313b912.exe Token: SeTcbPrivilege 688 Tue01bf08f313b912.exe Token: SeSecurityPrivilege 688 Tue01bf08f313b912.exe Token: SeTakeOwnershipPrivilege 688 Tue01bf08f313b912.exe Token: SeLoadDriverPrivilege 688 Tue01bf08f313b912.exe Token: SeSystemProfilePrivilege 688 Tue01bf08f313b912.exe Token: SeSystemtimePrivilege 688 Tue01bf08f313b912.exe Token: SeProfSingleProcessPrivilege 688 Tue01bf08f313b912.exe Token: SeIncBasePriorityPrivilege 688 Tue01bf08f313b912.exe Token: SeCreatePagefilePrivilege 688 Tue01bf08f313b912.exe Token: SeCreatePermanentPrivilege 688 Tue01bf08f313b912.exe Token: SeBackupPrivilege 688 Tue01bf08f313b912.exe Token: SeRestorePrivilege 688 Tue01bf08f313b912.exe Token: SeShutdownPrivilege 688 Tue01bf08f313b912.exe Token: SeDebugPrivilege 688 Tue01bf08f313b912.exe Token: SeAuditPrivilege 688 Tue01bf08f313b912.exe Token: SeSystemEnvironmentPrivilege 688 Tue01bf08f313b912.exe Token: SeChangeNotifyPrivilege 688 Tue01bf08f313b912.exe Token: SeRemoteShutdownPrivilege 688 Tue01bf08f313b912.exe Token: SeUndockPrivilege 688 Tue01bf08f313b912.exe Token: SeSyncAgentPrivilege 688 Tue01bf08f313b912.exe Token: SeEnableDelegationPrivilege 688 Tue01bf08f313b912.exe Token: SeManageVolumePrivilege 688 Tue01bf08f313b912.exe Token: SeImpersonatePrivilege 688 Tue01bf08f313b912.exe Token: SeCreateGlobalPrivilege 688 Tue01bf08f313b912.exe Token: 31 688 Tue01bf08f313b912.exe Token: 32 688 Tue01bf08f313b912.exe Token: 33 688 Tue01bf08f313b912.exe Token: 34 688 Tue01bf08f313b912.exe Token: 35 688 Tue01bf08f313b912.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4012 Tue01c451610f4a.exe 4012 Tue01c451610f4a.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4012 Tue01c451610f4a.exe 4012 Tue01c451610f4a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1272 wrote to memory of 820 1272 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 69 PID 1272 wrote to memory of 820 1272 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 69 PID 1272 wrote to memory of 820 1272 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 69 PID 820 wrote to memory of 3816 820 setup_installer.exe 70 PID 820 wrote to memory of 3816 820 setup_installer.exe 70 PID 820 wrote to memory of 3816 820 setup_installer.exe 70 PID 3816 wrote to memory of 1416 3816 setup_install.exe 73 PID 3816 wrote to memory of 1416 3816 setup_install.exe 73 PID 3816 wrote to memory of 1416 3816 setup_install.exe 73 PID 3816 wrote to memory of 704 3816 setup_install.exe 74 PID 3816 wrote to memory of 704 3816 setup_install.exe 74 PID 3816 wrote to memory of 704 3816 setup_install.exe 74 PID 3816 wrote to memory of 420 3816 setup_install.exe 75 PID 3816 wrote to memory of 420 3816 setup_install.exe 75 PID 3816 wrote to memory of 420 3816 setup_install.exe 75 PID 3816 wrote to memory of 1752 3816 setup_install.exe 76 PID 3816 wrote to memory of 1752 3816 setup_install.exe 76 PID 3816 wrote to memory of 1752 3816 setup_install.exe 76 PID 3816 wrote to memory of 3612 3816 setup_install.exe 77 PID 3816 wrote to memory of 3612 3816 setup_install.exe 77 PID 3816 wrote to memory of 3612 3816 setup_install.exe 77 PID 3816 wrote to memory of 3036 3816 setup_install.exe 78 PID 3816 wrote to memory of 3036 3816 setup_install.exe 78 PID 3816 wrote to memory of 3036 3816 setup_install.exe 78 PID 3816 wrote to memory of 1412 3816 setup_install.exe 95 PID 3816 wrote to memory of 1412 3816 setup_install.exe 95 PID 3816 wrote to memory of 1412 3816 setup_install.exe 95 PID 3816 wrote to memory of 1776 3816 setup_install.exe 94 PID 3816 wrote to memory of 1776 3816 setup_install.exe 94 PID 3816 wrote to memory of 1776 3816 setup_install.exe 94 PID 3036 wrote to memory of 1028 3036 cmd.exe 93 PID 3036 wrote to memory of 1028 3036 cmd.exe 93 PID 3036 wrote to memory of 1028 3036 cmd.exe 93 PID 704 wrote to memory of 440 704 cmd.exe 79 PID 704 wrote to memory of 440 704 cmd.exe 79 PID 704 wrote to memory of 440 704 cmd.exe 79 PID 1416 wrote to memory of 2064 1416 cmd.exe 83 PID 1416 wrote to memory of 2064 1416 cmd.exe 83 PID 1416 wrote to memory of 2064 1416 cmd.exe 83 PID 3816 wrote to memory of 1168 3816 setup_install.exe 82 PID 3816 wrote to memory of 1168 3816 setup_install.exe 82 PID 3816 wrote to memory of 1168 3816 setup_install.exe 82 PID 3816 wrote to memory of 1180 3816 setup_install.exe 80 PID 3816 wrote to memory of 1180 3816 setup_install.exe 80 PID 3816 wrote to memory of 1180 3816 setup_install.exe 80 PID 1168 wrote to memory of 1724 1168 cmd.exe 81 PID 1168 wrote to memory of 1724 1168 cmd.exe 81 PID 1752 wrote to memory of 1424 1752 cmd.exe 92 PID 1752 wrote to memory of 1424 1752 cmd.exe 92 PID 1752 wrote to memory of 1424 1752 cmd.exe 92 PID 3816 wrote to memory of 2308 3816 setup_install.exe 91 PID 3816 wrote to memory of 2308 3816 setup_install.exe 91 PID 3816 wrote to memory of 2308 3816 setup_install.exe 91 PID 3612 wrote to memory of 1696 3612 cmd.exe 84 PID 3612 wrote to memory of 1696 3612 cmd.exe 84 PID 420 wrote to memory of 1908 420 cmd.exe 90 PID 420 wrote to memory of 1908 420 cmd.exe 90 PID 420 wrote to memory of 1908 420 cmd.exe 90 PID 3816 wrote to memory of 2096 3816 setup_install.exe 89 PID 3816 wrote to memory of 2096 3816 setup_install.exe 89 PID 3816 wrote to memory of 2096 3816 setup_install.exe 89 PID 1776 wrote to memory of 4012 1776 cmd.exe 88 PID 1776 wrote to memory of 4012 1776 cmd.exe 88 PID 1776 wrote to memory of 4012 1776 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS43314B06\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵PID:2064
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe4⤵
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01d702368dbba.exeTue01d702368dbba.exe5⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\is-DMEVN.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-DMEVN.tmp\Tue01d702368dbba.tmp" /SL5="$50112,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01d702368dbba.exe"6⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01d702368dbba.exe"C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01d702368dbba.exe" /SILENT7⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\is-56V6D.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-56V6D.tmp\Tue01d702368dbba.tmp" /SL5="$10216,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01d702368dbba.exe" /SILENT8⤵PID:4440
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0133c29150b.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue0133c29150b.exeTue0133c29150b.exe5⤵
- Executes dropped EXE
PID:1424
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01994ec7a792fea9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01994ec7a792fea9.exeTue01994ec7a792fea9.exe5⤵
- Executes dropped EXE
PID:1696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue018f791563585c0f9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue018f791563585c0f9.exeTue018f791563585c0f9.exe5⤵
- Executes dropped EXE
PID:1028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0138d4026db6d813e.exe /mixone4⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue0138d4026db6d813e.exeTue0138d4026db6d813e.exe /mixone5⤵
- Executes dropped EXE
PID:2880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 6686⤵
- Program crash
PID:4512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 6766⤵
- Program crash
PID:1308
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue010769fc7f9829.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01e8898e0d1fce4.exe4⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01e8898e0d1fce4.exeTue01e8898e0d1fce4.exe5⤵
- Executes dropped EXE
PID:3204 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01e8898e0d1fce4.exe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If """" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01e8898e0d1fce4.exe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )6⤵PID:4280
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01bba8b80fa4.exe4⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01bba8b80fa4.exeTue01bba8b80fa4.exe5⤵
- Executes dropped EXE
PID:1272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0195119235.exe4⤵PID:2096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue018bc5c5a0a3d4.exe4⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue018bc5c5a0a3d4.exeTue018bc5c5a0a3d4.exe5⤵
- Executes dropped EXE
PID:3856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01c451610f4a.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue017abac33187.exe4⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue017abac33187.exeTue017abac33187.exe5⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue017abac33187.exe6⤵PID:4452
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01bf08f313b912.exe4⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01bf08f313b912.exeTue01bf08f313b912.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0105f10596.exe4⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue0105f10596.exeTue0105f10596.exe5⤵PID:3444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0121ab289cd9a.exe4⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue0121ab289cd9a.exeTue0121ab289cd9a.exe5⤵PID:3768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01de2411919659f09.exe4⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01de2411919659f09.exeTue01de2411919659f09.exe5⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01de2411919659f09.exeC:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01de2411919659f09.exe6⤵PID:4472
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 5364⤵
- Program crash
PID:3548
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue010769fc7f9829.exeTue010769fc7f9829.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue0195119235.exeTue0195119235.exe1⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue0195119235.exe"C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue0195119235.exe" -u2⤵
- Executes dropped EXE
PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01c451610f4a.exeTue01c451610f4a.exe1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4012 -
C:\Users\Public\run.exeC:\Users\Public\run.exe2⤵PID:4788
-
-
C:\Users\Public\run2.exeC:\Users\Public\run2.exe2⤵PID:4804
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01e8898e0d1fce4.exe" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv &If "" == "" for %K in ("C:\Users\Admin\AppData\Local\Temp\7zS43314B06\Tue01e8898e0d1fce4.exe") do taskkill /f /IM "%~NXK"1⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv2⤵PID:4996
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If ""/pzztRb0w26vFPLWe3xRyQv "" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )3⤵PID:3176
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv &If "/pzztRb0w26vFPLWe3xRyQv " == "" for %K in ("C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe") do taskkill /f /IM "%~NXK"4⤵PID:4308
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /IM "Tue01e8898e0d1fce4.exe"2⤵
- Kills process with taskkill
PID:5084
-