Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
76s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24/05/2022, 00:42
Static task
static1
Behavioral task
behavioral1
Sample
8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
Resource
win7-20220414-en
General
-
Target
8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
-
Size
340KB
-
MD5
b2dc23e3ac76194e9ad5aee22b35267f
-
SHA1
98ab0d3125556c7fd2cc5e1ac95f8e53e1598c2e
-
SHA256
8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d
-
SHA512
f4bf84930d6d5ae1da8624be63d3d6cea2b94eda3a09dfc978a3e0556d7e077052bc03ea1195a50f6037a5c36567a8656d519f7f1d6e36482487caf5854cc86d
Malware Config
Signatures
-
Detects PlugX Payload 4 IoCs
resource yara_rule behavioral1/memory/1972-77-0x0000000000880000-0x00000000008D1000-memory.dmp family_plugx behavioral1/memory/1712-78-0x0000000000830000-0x0000000000881000-memory.dmp family_plugx behavioral1/memory/680-84-0x0000000000390000-0x00000000003E1000-memory.dmp family_plugx behavioral1/memory/1724-89-0x00000000003B0000-0x0000000000401000-memory.dmp family_plugx -
Executes dropped EXE 3 IoCs
pid Process 1972 NvSmartMaxAPP.exe 1712 NvSmartMaxAPP.exe 1984 check_run_environment.exe -
Deletes itself 1 IoCs
pid Process 680 svchost.exe -
Loads dropped DLL 9 IoCs
pid Process 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 1972 NvSmartMaxAPP.exe 1712 NvSmartMaxAPP.exe 1712 NvSmartMaxAPP.exe 1712 NvSmartMaxAPP.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1816 taskkill.exe -
Modifies data under HKEY_USERS 55 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\9e-af-d0-55-28-1b svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ NvSmartMaxAPP.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" NvSmartMaxAPP.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = b065910b186fd801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDetectedUrl svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 703c8706186fd801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 703c8706186fd801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadNetworkName = "Network 2" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = f0ea87f5176fd801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 50e58a10186fd801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" NvSmartMaxAPP.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = f0ea87f5176fd801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 10fa8801186fd801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 70849816186fd801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 10fa8801186fd801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = b065910b186fd801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 50e58a10186fd801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 909383fc176fd801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 909383fc176fd801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000008000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 70849816186fd801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionReason = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 30003000360032003100330044004300430041003700450037003400440046000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 check_run_environment.exe 1984 check_run_environment.exe 680 svchost.exe 680 svchost.exe 680 svchost.exe 680 svchost.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 680 svchost.exe 680 svchost.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 680 svchost.exe 680 svchost.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 680 svchost.exe 680 svchost.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 680 svchost.exe 680 svchost.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 680 svchost.exe 680 svchost.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 680 svchost.exe 680 svchost.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe 1724 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1972 NvSmartMaxAPP.exe Token: SeTcbPrivilege 1972 NvSmartMaxAPP.exe Token: SeDebugPrivilege 1712 NvSmartMaxAPP.exe Token: SeTcbPrivilege 1712 NvSmartMaxAPP.exe Token: SeTcbPrivilege 1984 check_run_environment.exe Token: SeDebugPrivilege 1984 check_run_environment.exe Token: SeDebugPrivilege 680 svchost.exe Token: SeTcbPrivilege 680 svchost.exe Token: SeDebugPrivilege 1816 taskkill.exe Token: SeDebugPrivilege 1724 msiexec.exe Token: SeTcbPrivilege 1724 msiexec.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 800 wrote to memory of 1972 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 28 PID 800 wrote to memory of 1972 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 28 PID 800 wrote to memory of 1972 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 28 PID 800 wrote to memory of 1972 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 28 PID 800 wrote to memory of 1972 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 28 PID 800 wrote to memory of 1972 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 28 PID 800 wrote to memory of 1972 800 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe 28 PID 1712 wrote to memory of 1984 1712 NvSmartMaxAPP.exe 30 PID 1712 wrote to memory of 1984 1712 NvSmartMaxAPP.exe 30 PID 1712 wrote to memory of 1984 1712 NvSmartMaxAPP.exe 30 PID 1712 wrote to memory of 1984 1712 NvSmartMaxAPP.exe 30 PID 1984 wrote to memory of 464 1984 check_run_environment.exe 2 PID 1712 wrote to memory of 1816 1712 NvSmartMaxAPP.exe 34 PID 1712 wrote to memory of 1816 1712 NvSmartMaxAPP.exe 34 PID 1712 wrote to memory of 1816 1712 NvSmartMaxAPP.exe 34 PID 1712 wrote to memory of 1816 1712 NvSmartMaxAPP.exe 34 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 1712 wrote to memory of 680 1712 NvSmartMaxAPP.exe 31 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35 PID 680 wrote to memory of 1724 680 svchost.exe 35
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\ProgramData\Intel\Intel(R) Management Engine Components\NvSmartMaxAPP.exe"C:\ProgramData\Intel\Intel(R) Management Engine Components\NvSmartMaxAPP.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\TEMP\check_run_environment.exe"C:\Windows\TEMP\check_run_environment.exe" "jhi_service"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 03⤵
- Deletes itself
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 6804⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im check_run_environment.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
-
-
C:\Users\Admin\AppData\Local\Temp\8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe"C:\Users\Admin\AppData\Local\Temp\8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c62c4b09c8543821e0ff2213c633f5e5
SHA1ff59b219fa140c48536d79a9a73027d4acf40bc9
SHA2565afa8e6c54f264eb87c75e3c2a5b9b192fca608cb4b0ebeaf5c92a384c1e135c
SHA5128e7ec29bbc3ed496821fa1ff4e95360b2ec33e093a74ed9021329d0f018cd07153e44a644b45674e808d04ad8b71bc4d75ff9cb34f9231f07fd0dadd0cb86c4e
-
Filesize
212KB
MD5cdbf515d885c303ff2b2c6cf182fa19b
SHA19bc67dd9f4718f0dd3a995b5a41eac788f8ae76b
SHA2563203294c334b0cc5db4e2bf09fdab1dc9bbcb6f536cef4db5c9ae275c0ac569c
SHA512d8a4c196ff9cf708fe394519b27d4ed1b156b03ab43d1aae11b5ec49c557e9b6332194f74671010ab778beea39db3fcd78b8a98e9e4ed2fcc5360226d1e9f359
-
Filesize
60KB
MD54e3cae0eda4c873b0afdb803ea981a0d
SHA106ddb2a4a1c4d119efeed10147666afa0c4eda25
SHA25611a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e
SHA512c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431
-
Filesize
4KB
MD5c62c4b09c8543821e0ff2213c633f5e5
SHA1ff59b219fa140c48536d79a9a73027d4acf40bc9
SHA2565afa8e6c54f264eb87c75e3c2a5b9b192fca608cb4b0ebeaf5c92a384c1e135c
SHA5128e7ec29bbc3ed496821fa1ff4e95360b2ec33e093a74ed9021329d0f018cd07153e44a644b45674e808d04ad8b71bc4d75ff9cb34f9231f07fd0dadd0cb86c4e
-
Filesize
212KB
MD5cdbf515d885c303ff2b2c6cf182fa19b
SHA19bc67dd9f4718f0dd3a995b5a41eac788f8ae76b
SHA2563203294c334b0cc5db4e2bf09fdab1dc9bbcb6f536cef4db5c9ae275c0ac569c
SHA512d8a4c196ff9cf708fe394519b27d4ed1b156b03ab43d1aae11b5ec49c557e9b6332194f74671010ab778beea39db3fcd78b8a98e9e4ed2fcc5360226d1e9f359
-
Filesize
60KB
MD54e3cae0eda4c873b0afdb803ea981a0d
SHA106ddb2a4a1c4d119efeed10147666afa0c4eda25
SHA25611a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e
SHA512c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431
-
Filesize
60KB
MD54e3cae0eda4c873b0afdb803ea981a0d
SHA106ddb2a4a1c4d119efeed10147666afa0c4eda25
SHA25611a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e
SHA512c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431
-
Filesize
11KB
MD56622918d92a44e67175f7aeb3fcb5a05
SHA10b226563fa229783bea7aa27e28f908967c729e6
SHA256b0e1832ff379dfbfeac0aa26ba49188019d2aa7a5ead67256ef7f10ed8a6c62c
SHA51265ff16d6d4eb4308f5950dec33b7598c10da54e4ae124107f19159675cc2cc445da8b70a5cb5f509b7c988358f1973b77b3be361d712a3cd44bda6e3697008fe
-
Filesize
4KB
MD5c62c4b09c8543821e0ff2213c633f5e5
SHA1ff59b219fa140c48536d79a9a73027d4acf40bc9
SHA2565afa8e6c54f264eb87c75e3c2a5b9b192fca608cb4b0ebeaf5c92a384c1e135c
SHA5128e7ec29bbc3ed496821fa1ff4e95360b2ec33e093a74ed9021329d0f018cd07153e44a644b45674e808d04ad8b71bc4d75ff9cb34f9231f07fd0dadd0cb86c4e
-
Filesize
4KB
MD5c62c4b09c8543821e0ff2213c633f5e5
SHA1ff59b219fa140c48536d79a9a73027d4acf40bc9
SHA2565afa8e6c54f264eb87c75e3c2a5b9b192fca608cb4b0ebeaf5c92a384c1e135c
SHA5128e7ec29bbc3ed496821fa1ff4e95360b2ec33e093a74ed9021329d0f018cd07153e44a644b45674e808d04ad8b71bc4d75ff9cb34f9231f07fd0dadd0cb86c4e
-
Filesize
60KB
MD54e3cae0eda4c873b0afdb803ea981a0d
SHA106ddb2a4a1c4d119efeed10147666afa0c4eda25
SHA25611a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e
SHA512c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431
-
Filesize
60KB
MD54e3cae0eda4c873b0afdb803ea981a0d
SHA106ddb2a4a1c4d119efeed10147666afa0c4eda25
SHA25611a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e
SHA512c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431
-
Filesize
60KB
MD54e3cae0eda4c873b0afdb803ea981a0d
SHA106ddb2a4a1c4d119efeed10147666afa0c4eda25
SHA25611a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e
SHA512c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431
-
Filesize
60KB
MD54e3cae0eda4c873b0afdb803ea981a0d
SHA106ddb2a4a1c4d119efeed10147666afa0c4eda25
SHA25611a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e
SHA512c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431
-
Filesize
60KB
MD54e3cae0eda4c873b0afdb803ea981a0d
SHA106ddb2a4a1c4d119efeed10147666afa0c4eda25
SHA25611a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e
SHA512c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431
-
Filesize
11KB
MD56622918d92a44e67175f7aeb3fcb5a05
SHA10b226563fa229783bea7aa27e28f908967c729e6
SHA256b0e1832ff379dfbfeac0aa26ba49188019d2aa7a5ead67256ef7f10ed8a6c62c
SHA51265ff16d6d4eb4308f5950dec33b7598c10da54e4ae124107f19159675cc2cc445da8b70a5cb5f509b7c988358f1973b77b3be361d712a3cd44bda6e3697008fe
-
Filesize
11KB
MD56622918d92a44e67175f7aeb3fcb5a05
SHA10b226563fa229783bea7aa27e28f908967c729e6
SHA256b0e1832ff379dfbfeac0aa26ba49188019d2aa7a5ead67256ef7f10ed8a6c62c
SHA51265ff16d6d4eb4308f5950dec33b7598c10da54e4ae124107f19159675cc2cc445da8b70a5cb5f509b7c988358f1973b77b3be361d712a3cd44bda6e3697008fe