Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe
Resource
win10v2004-20220812-en
General
-
Target
7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe
-
Size
44KB
-
MD5
8ea6e59478ab79f1e499f2d37a7fa82a
-
SHA1
cac1b390cb01d4129c9a323597ed7f2cf044905a
-
SHA256
7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6
-
SHA512
9b2b2df81daf23f4e236ffc33f78ea81ae82e220c231860076eb848b94263850da2b630e512a2733bd61e416c1ba5db88f426d5e497cb6a9962fd0a0af91c882
-
SSDEEP
768:D3rnGHcFIKtK3y89pXdqKIsG4qTDMqR7AtmqDgfj70319irrHoSpEYW:TrGmt2y8kLDMqNANgX031i1iYW
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4280 h4ckdn1234.exe 564 h4ckdn1234.exe 4584 h4ckdn1234.exe 4900 h4ckdn1234.exe 2128 h4ckdn1234.exe 4284 h4ckdn1234.exe 4760 h4ckdn1234.exe 4504 h4ckdn1234.exe 2488 h4ckdn1234.exe 4660 h4ckdn1234.exe 824 h4ckdn1234.exe 4912 h4ckdn1234.exe 5060 h4ckdn1234.exe 4084 h4ckdn1234.exe 1916 h4ckdn1234.exe 1796 h4ckdn1234.exe 3768 h4ckdn1234.exe 2464 h4ckdn1234.exe 5016 h4ckdn1234.exe 1996 h4ckdn1234.exe 2460 h4ckdn1234.exe 620 h4ckdn1234.exe 2536 h4ckdn1234.exe 412 h4ckdn1234.exe 1296 h4ckdn1234.exe 1816 h4ckdn1234.exe 240 h4ckdn1234.exe 220 h4ckdn1234.exe 2888 h4ckdn1234.exe 4460 h4ckdn1234.exe 4680 h4ckdn1234.exe 3508 h4ckdn1234.exe 3160 h4ckdn1234.exe 3996 h4ckdn1234.exe 3044 h4ckdn1234.exe 4232 h4ckdn1234.exe 2732 h4ckdn1234.exe 5100 h4ckdn1234.exe 4996 h4ckdn1234.exe 1760 h4ckdn1234.exe 2348 h4ckdn1234.exe 2548 h4ckdn1234.exe 676 h4ckdn1234.exe 1040 h4ckdn1234.exe 3060 h4ckdn1234.exe 1976 h4ckdn1234.exe 3776 h4ckdn1234.exe 4216 h4ckdn1234.exe 2860 h4ckdn1234.exe 4404 h4ckdn1234.exe 3276 h4ckdn1234.exe 3416 h4ckdn1234.exe 1332 h4ckdn1234.exe 4792 h4ckdn1234.exe 3664 h4ckdn1234.exe 3448 h4ckdn1234.exe 1276 h4ckdn1234.exe 4668 h4ckdn1234.exe 2540 h4ckdn1234.exe 2980 h4ckdn1234.exe 2724 h4ckdn1234.exe 4804 h4ckdn1234.exe 3944 h4ckdn1234.exe 4788 h4ckdn1234.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\h4ckdn1234 = "C:\\Windows\\system32\\h4ckdn1234.exe" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run h4ckdn1234.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies WinLogon 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\StopScreenSaver = "WLEStopScreenSaver" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logoff = "WLELogoff" h4ckdn1234.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Impersonate = "0" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Startup = "WLEStartup" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Lock = "WLELock" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Startup = "WLEStartup" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Lock = "WLELock" h4ckdn1234.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Asynchronous = "0" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logoff = "WLELogoff" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\DllName = "h4ckdn1234.dll" h4ckdn1234.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Impersonate = "0" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logon = "WLELogon" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Startup = "WLEStartup" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logon = "WLELogon" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logon = "WLELogon" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\DllName = "h4ckdn1234.dll" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logon = "WLELogon" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logon = "WLELogon" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logoff = "WLELogoff" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Shutdown = "WLEShutdown" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Lock = "WLELock" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\DllName = "h4ckdn1234.dll" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Lock = "WLELock" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\DllName = "h4ckdn1234.dll" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logon = "WLELogon" h4ckdn1234.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Impersonate = "0" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Lock = "WLELock" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Unlock = "WLEUnlock" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234 h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logoff = "WLELogoff" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Shutdown = "WLEShutdown" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logoff = "WLELogoff" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Lock = "WLELock" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Shutdown = "WLEShutdown" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Unlock = "WLEUnlock" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234 h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\DllName = "h4ckdn1234.dll" h4ckdn1234.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Asynchronous = "0" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\StartScreenSaver = "WLEStartScreenSaver" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Startup = "WLEStartup" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234 h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logon = "WLELogon" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logoff = "WLELogoff" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\StartScreenSaver = "WLEStartScreenSaver" h4ckdn1234.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Asynchronous = "0" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\StopScreenSaver = "WLEStopScreenSaver" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Shutdown = "WLEShutdown" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logoff = "WLELogoff" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\DllName = "h4ckdn1234.dll" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Lock = "WLELock" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\StartScreenSaver = "WLEStartScreenSaver" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\StartScreenSaver = "WLEStartScreenSaver" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\DllName = "h4ckdn1234.dll" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\StartScreenSaver = "WLEStartScreenSaver" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Logoff = "WLELogoff" h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Unlock = "WLEUnlock" h4ckdn1234.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Asynchronous = "0" h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify h4ckdn1234.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify h4ckdn1234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Lock = "WLELock" h4ckdn1234.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\h4ckdn1234\Impersonate = "0" h4ckdn1234.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\h4ckdn1234.dll 7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe File created C:\Windows\SysWOW64\h4ckdn1234.exe h4ckdn1234.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3180 wrote to memory of 4280 3180 7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe 80 PID 3180 wrote to memory of 4280 3180 7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe 80 PID 3180 wrote to memory of 4280 3180 7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe 80 PID 4280 wrote to memory of 564 4280 h4ckdn1234.exe 81 PID 4280 wrote to memory of 564 4280 h4ckdn1234.exe 81 PID 4280 wrote to memory of 564 4280 h4ckdn1234.exe 81 PID 564 wrote to memory of 4584 564 h4ckdn1234.exe 82 PID 564 wrote to memory of 4584 564 h4ckdn1234.exe 82 PID 564 wrote to memory of 4584 564 h4ckdn1234.exe 82 PID 4584 wrote to memory of 4900 4584 h4ckdn1234.exe 83 PID 4584 wrote to memory of 4900 4584 h4ckdn1234.exe 83 PID 4584 wrote to memory of 4900 4584 h4ckdn1234.exe 83 PID 4900 wrote to memory of 2128 4900 h4ckdn1234.exe 84 PID 4900 wrote to memory of 2128 4900 h4ckdn1234.exe 84 PID 4900 wrote to memory of 2128 4900 h4ckdn1234.exe 84 PID 2128 wrote to memory of 4284 2128 h4ckdn1234.exe 85 PID 2128 wrote to memory of 4284 2128 h4ckdn1234.exe 85 PID 2128 wrote to memory of 4284 2128 h4ckdn1234.exe 85 PID 4284 wrote to memory of 4760 4284 h4ckdn1234.exe 86 PID 4284 wrote to memory of 4760 4284 h4ckdn1234.exe 86 PID 4284 wrote to memory of 4760 4284 h4ckdn1234.exe 86 PID 4760 wrote to memory of 4504 4760 h4ckdn1234.exe 87 PID 4760 wrote to memory of 4504 4760 h4ckdn1234.exe 87 PID 4760 wrote to memory of 4504 4760 h4ckdn1234.exe 87 PID 4504 wrote to memory of 2488 4504 h4ckdn1234.exe 88 PID 4504 wrote to memory of 2488 4504 h4ckdn1234.exe 88 PID 4504 wrote to memory of 2488 4504 h4ckdn1234.exe 88 PID 2488 wrote to memory of 4660 2488 h4ckdn1234.exe 89 PID 2488 wrote to memory of 4660 2488 h4ckdn1234.exe 89 PID 2488 wrote to memory of 4660 2488 h4ckdn1234.exe 89 PID 4660 wrote to memory of 824 4660 h4ckdn1234.exe 90 PID 4660 wrote to memory of 824 4660 h4ckdn1234.exe 90 PID 4660 wrote to memory of 824 4660 h4ckdn1234.exe 90 PID 824 wrote to memory of 4912 824 h4ckdn1234.exe 91 PID 824 wrote to memory of 4912 824 h4ckdn1234.exe 91 PID 824 wrote to memory of 4912 824 h4ckdn1234.exe 91 PID 4912 wrote to memory of 5060 4912 h4ckdn1234.exe 92 PID 4912 wrote to memory of 5060 4912 h4ckdn1234.exe 92 PID 4912 wrote to memory of 5060 4912 h4ckdn1234.exe 92 PID 5060 wrote to memory of 4084 5060 h4ckdn1234.exe 93 PID 5060 wrote to memory of 4084 5060 h4ckdn1234.exe 93 PID 5060 wrote to memory of 4084 5060 h4ckdn1234.exe 93 PID 4084 wrote to memory of 1916 4084 h4ckdn1234.exe 94 PID 4084 wrote to memory of 1916 4084 h4ckdn1234.exe 94 PID 4084 wrote to memory of 1916 4084 h4ckdn1234.exe 94 PID 1916 wrote to memory of 1796 1916 h4ckdn1234.exe 95 PID 1916 wrote to memory of 1796 1916 h4ckdn1234.exe 95 PID 1916 wrote to memory of 1796 1916 h4ckdn1234.exe 95 PID 1796 wrote to memory of 3768 1796 h4ckdn1234.exe 96 PID 1796 wrote to memory of 3768 1796 h4ckdn1234.exe 96 PID 1796 wrote to memory of 3768 1796 h4ckdn1234.exe 96 PID 3768 wrote to memory of 2464 3768 h4ckdn1234.exe 97 PID 3768 wrote to memory of 2464 3768 h4ckdn1234.exe 97 PID 3768 wrote to memory of 2464 3768 h4ckdn1234.exe 97 PID 2464 wrote to memory of 5016 2464 h4ckdn1234.exe 98 PID 2464 wrote to memory of 5016 2464 h4ckdn1234.exe 98 PID 2464 wrote to memory of 5016 2464 h4ckdn1234.exe 98 PID 5016 wrote to memory of 1996 5016 h4ckdn1234.exe 99 PID 5016 wrote to memory of 1996 5016 h4ckdn1234.exe 99 PID 5016 wrote to memory of 1996 5016 h4ckdn1234.exe 99 PID 1996 wrote to memory of 2460 1996 h4ckdn1234.exe 100 PID 1996 wrote to memory of 2460 1996 h4ckdn1234.exe 100 PID 1996 wrote to memory of 2460 1996 h4ckdn1234.exe 100 PID 2460 wrote to memory of 620 2460 h4ckdn1234.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe"C:\Users\Admin\AppData\Local\Temp\7dd4fd6b6a5f45bee6b53e266b6cbf734a11814301a88d0d4dfa608fae6ed0b6.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe14⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe23⤵
- Executes dropped EXE
PID:620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe1⤵
- Executes dropped EXE
PID:412 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe2⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe3⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe4⤵
- Executes dropped EXE
- Modifies WinLogon
PID:240 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe5⤵
- Executes dropped EXE
PID:220 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe6⤵
- Executes dropped EXE
PID:2888 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe7⤵
- Executes dropped EXE
PID:4460 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe8⤵
- Executes dropped EXE
PID:4680 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe9⤵
- Executes dropped EXE
PID:3508 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe10⤵
- Executes dropped EXE
PID:3160 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe11⤵
- Executes dropped EXE
PID:3996 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe12⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe13⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4232 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe14⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe15⤵
- Executes dropped EXE
PID:5100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2536
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe1⤵
- Executes dropped EXE
- Modifies WinLogon
PID:4996 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1760 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe3⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe4⤵
- Executes dropped EXE
PID:2548 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe5⤵
- Executes dropped EXE
PID:676 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe6⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe7⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe8⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe9⤵
- Executes dropped EXE
- Modifies WinLogon
PID:3776 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe10⤵
- Executes dropped EXE
PID:4216 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2860 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe12⤵
- Executes dropped EXE
PID:4404 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe13⤵
- Executes dropped EXE
PID:3276 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe14⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe15⤵
- Executes dropped EXE
- Modifies WinLogon
PID:1332 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe16⤵
- Executes dropped EXE
PID:4792 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe17⤵
- Executes dropped EXE
PID:3664 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe18⤵
- Executes dropped EXE
PID:3448 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe19⤵
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe20⤵
- Executes dropped EXE
- Modifies WinLogon
PID:4668 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe21⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
PID:2540 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe22⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe23⤵
- Executes dropped EXE
- Modifies WinLogon
PID:2724 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe24⤵
- Executes dropped EXE
PID:4804 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe25⤵
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe26⤵
- Executes dropped EXE
- Modifies WinLogon
PID:4788 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe27⤵PID:4248
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe28⤵PID:1948
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe29⤵PID:3560
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe30⤵
- Adds Run key to start application
PID:2820 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe31⤵PID:3900
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe32⤵PID:4456
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe33⤵PID:2740
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe34⤵PID:2424
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe35⤵PID:4344
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe36⤵PID:3548
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe37⤵PID:1348
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe38⤵PID:4568
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe39⤵
- Modifies WinLogon
PID:5028 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe40⤵
- Drops file in System32 directory
PID:4784 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe41⤵PID:704
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe42⤵PID:3068
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe43⤵PID:228
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe44⤵PID:1644
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe45⤵PID:2032
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe46⤵PID:3092
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe47⤵
- Drops file in System32 directory
PID:2288 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe48⤵PID:3896
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe49⤵PID:3528
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe50⤵PID:2832
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe51⤵PID:4240
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe52⤵PID:4496
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe53⤵PID:2332
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe54⤵PID:3908
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe55⤵PID:1112
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe56⤵PID:956
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe57⤵PID:4012
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe58⤵PID:1428
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe59⤵PID:2036
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe60⤵PID:4696
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe61⤵
- Adds Run key to start application
PID:5132 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe62⤵PID:5152
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe63⤵
- Adds Run key to start application
PID:5176 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe64⤵PID:5196
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe65⤵PID:5220
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe66⤵PID:5240
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe67⤵PID:5260
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe68⤵PID:5280
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe69⤵PID:5300
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe70⤵PID:5320
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe71⤵
- Modifies WinLogon
PID:5340 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe72⤵
- Modifies WinLogon
PID:5364 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe73⤵PID:5384
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe74⤵PID:5404
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe75⤵
- Drops file in System32 directory
PID:5424 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe76⤵PID:5444
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe77⤵PID:5464
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe78⤵PID:5484
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe79⤵PID:5504
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe80⤵PID:5524
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe81⤵PID:5544
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe82⤵PID:5568
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe83⤵
- Drops file in System32 directory
PID:5588 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe84⤵PID:5608
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe85⤵
- Adds Run key to start application
PID:5628 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe86⤵PID:5648
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe87⤵PID:5668
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe88⤵PID:5688
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe89⤵PID:5708
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe90⤵PID:5728
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe91⤵PID:5752
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe92⤵PID:5772
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe93⤵PID:5792
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe94⤵PID:5812
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe95⤵PID:5832
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe96⤵PID:5852
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe97⤵PID:5872
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe98⤵PID:5896
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe99⤵PID:5916
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe100⤵
- Drops file in System32 directory
PID:5936 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe101⤵PID:5956
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe102⤵PID:5976
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe103⤵PID:5996
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe104⤵PID:6016
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe105⤵PID:6036
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe106⤵PID:6056
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe107⤵PID:6080
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe108⤵PID:6100
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe109⤵
- Modifies WinLogon
PID:6120 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe110⤵PID:6140
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe111⤵PID:1456
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe112⤵
- Adds Run key to start application
PID:6160 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe113⤵PID:6180
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe114⤵PID:6200
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe115⤵PID:6220
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe116⤵
- Modifies WinLogon
PID:6240 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe117⤵
- Drops file in System32 directory
PID:6260 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe118⤵PID:6280
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe119⤵PID:6300
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe120⤵PID:6320
-
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe121⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:6340 -
C:\Windows\SysWOW64\h4ckdn1234.exeC:\Windows\system32\h4ckdn1234.exe122⤵PID:6360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-