Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe
Resource
win7-20220812-en
General
-
Target
fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe
-
Size
632KB
-
MD5
6e19ed93b77d42d41b79c3c176a85ee0
-
SHA1
3118e8b2b411e63883dbc1ebd5b86a8e9982d888
-
SHA256
fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e
-
SHA512
9c3c5174073a96a8a42abff0c9f8eb69887d87a0d354a8791daff792a58c69fd5a22a10c5e8cc90c6f40f232184764c8e87159c4d08e01a42f72fd6bad5ec6a7
-
SSDEEP
12288:a61vvgdFneOSg7vAmbFsBPuDraeXPOZgKbJHK/re7oPMF:a2nuICXKB2DraeXPOZar2JF
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 9 IoCs
pid Process 848 mscorsvw.exe 468 Process not Found 1276 mscorsvw.exe 1324 mscorsvw.exe 1396 mscorsvw.exe 604 dllhost.exe 2024 mscorsvw.exe 1972 mscorsvw.exe 1880 elevation_service.exe -
Loads dropped DLL 5 IoCs
pid Process 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000 mscorsvw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000\EnableNotifications = "0" mscorsvw.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\alg.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\fxssvc.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\msdtc.exe mscorsvw.exe File created \??\c:\windows\system32\ibfkkikg.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\SysWOW64\hkembnhc.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\msdtc.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\ui0detect.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\ieetwcollector.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\snmptrap.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\hhplnopf.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\snmptrap.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\vssvc.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\wbengine.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\wbem\ciaenmnb.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\locator.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\alg.exe mscorsvw.exe File created \??\c:\windows\system32\jhkflfne.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\kmeijile.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\ieetwcollector.exe mscorsvw.exe File created \??\c:\windows\SysWOW64\daobpjgf.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\jhpgnddp.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\vds.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\cafjlkip.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\vds.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\svchost.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\dllhost.exe mscorsvw.exe File created \??\c:\windows\system32\lomlhjkh.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\msiexec.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\msiexec.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\searchindexer.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\qiboooja.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\alg.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\SysWOW64\njfbhcjl.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\lsass.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\locator.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\lbfjbcqj.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\svchost.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\SysWOW64\lcgcqdld.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe mscorsvw.exe File created \??\c:\windows\system32\jnpcmkko.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\ekfihhqp.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\ui0detect.exe mscorsvw.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\searchindexer.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\vssvc.exe mscorsvw.exe File opened for modification \??\c:\windows\system32\wbengine.exe mscorsvw.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\dllhost.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\system32\eoidpjlc.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\system32\lsass.exe mscorsvw.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe mscorsvw.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe mscorsvw.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\program files (x86)\common files\microsoft shared\source engine\abfnjbfg.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe mscorsvw.exe File created \??\c:\program files (x86)\mozilla maintenance service\bccppiep.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe mscorsvw.exe File created \??\c:\program files\windows media player\ablmljan.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\program files\google\chrome\Application\89.0.4389.114\kmgmehmp.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe mscorsvw.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\program files (x86)\microsoft office\office14\kjhomgmo.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created C:\Program Files\Internet Explorer\pknjoole.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\hiqmmang.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe mscorsvw.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe mscorsvw.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe -
Drops file in Windows directory 42 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\microsoft.net\framework64\v2.0.50727\qmbjpnba.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created \??\c:\windows\microsoft.net\framework64\v4.0.30319\docqgmdl.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\microsoft.net\framework\v4.0.30319\ncnegfij.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\microsoft.net\framework\v2.0.50727\abilkcmc.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created \??\c:\windows\microsoft.net\framework64\v4.0.30319\jmpeicbg.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe mscorsvw.exe File opened for modification \??\c:\windows\ehome\ehsched.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe mscorsvw.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File created \??\c:\windows\ehome\ekaopjcf.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe mscorsvw.exe File opened for modification \??\c:\windows\ehome\ehsched.exe mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{9AD03565-B9BA-43B7-9DDB-EDAC71F33DAF}.crmlog dllhost.exe File created \??\c:\windows\ehome\iikcbhaq.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe mscorsvw.exe File created \??\c:\windows\servicing\cmpjoodp.tmp fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe mscorsvw.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{9AD03565-B9BA-43B7-9DDB-EDAC71F33DAF}.crmlog dllhost.exe File created \??\c:\windows\servicing\henejgqj.tmp mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1396 mscorsvw.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1992 fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1992 fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe Token: SeShutdownPrivilege 1396 mscorsvw.exe Token: SeShutdownPrivilege 1396 mscorsvw.exe Token: SeShutdownPrivilege 1396 mscorsvw.exe Token: SeShutdownPrivilege 1396 mscorsvw.exe Token: SeTakeOwnershipPrivilege 1396 mscorsvw.exe Token: SeShutdownPrivilege 1396 mscorsvw.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1396 wrote to memory of 2024 1396 mscorsvw.exe 34 PID 1396 wrote to memory of 2024 1396 mscorsvw.exe 34 PID 1396 wrote to memory of 2024 1396 mscorsvw.exe 34 PID 1396 wrote to memory of 1972 1396 mscorsvw.exe 35 PID 1396 wrote to memory of 1972 1396 mscorsvw.exe 35 PID 1396 wrote to memory of 1972 1396 mscorsvw.exe 35 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer mscorsvw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" mscorsvw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe"C:\Users\Admin\AppData\Local\Temp\fc45cb15b9b99a536416062e19a241604bb47113b392b82335494204f69e6b7e.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:848
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1276
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
PID:1324
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1396 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 194 -NGENProcess 198 -Pipe 1a4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2024
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 220 -NGENProcess 200 -Pipe 21c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1972
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:604
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1880
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5171e0a3dea2ec4df231a9eb1758f4554
SHA1ba692d4fbd7fcdaee142f1b0b254691a862addaf
SHA256ca436624c573238fd348c0e09b2d1385920ea646f2c8a2d345cb04059f89c4bb
SHA512d0a03659323b5e1ee4fd91678477d91a0b9dcf06846d62419108734e90cb8881225dcc56f6448d48818c88d54efb8544d184db5be4217dd0ea1a8d5be9d886a6
-
Filesize
656KB
MD5c4126d00a24a94811b04d91780683ee4
SHA1304d6bd8c5f21a12e71d92d661cd8ed6ee91f82f
SHA2562ec95e8901480ef0bf0d946f6add1d249209b6386113bf0166a6d59315d1a151
SHA5127bc73dfda4afccd857d914b0ad1191fb84da8004359b8817aac8758c5866a4ae5315ed5fdd43a4069f8a617ab834b33380fd72d85c9fe80d94444b715487ff8a
-
Filesize
656KB
MD5c4126d00a24a94811b04d91780683ee4
SHA1304d6bd8c5f21a12e71d92d661cd8ed6ee91f82f
SHA2562ec95e8901480ef0bf0d946f6add1d249209b6386113bf0166a6d59315d1a151
SHA5127bc73dfda4afccd857d914b0ad1191fb84da8004359b8817aac8758c5866a4ae5315ed5fdd43a4069f8a617ab834b33380fd72d85c9fe80d94444b715487ff8a
-
Filesize
686KB
MD5029f2de388168c896cc97f4b6e6830f7
SHA108db30204b817a2ddc081231f262d7d2c15036d4
SHA256699f2f9d6a54ce01c0a53c6c04c50610703242213ff7f98f7adde1cee569c258
SHA512f413f931f5d120143aefad9a3a621a598b6e6d5d355d81209341c0a66c3bb1b00ddc435ceec8440abd1c881b6e7c2db083c6caa4749ab68b6360e3d7036fde0c
-
Filesize
686KB
MD5029f2de388168c896cc97f4b6e6830f7
SHA108db30204b817a2ddc081231f262d7d2c15036d4
SHA256699f2f9d6a54ce01c0a53c6c04c50610703242213ff7f98f7adde1cee569c258
SHA512f413f931f5d120143aefad9a3a621a598b6e6d5d355d81209341c0a66c3bb1b00ddc435ceec8440abd1c881b6e7c2db083c6caa4749ab68b6360e3d7036fde0c
-
Filesize
686KB
MD5029f2de388168c896cc97f4b6e6830f7
SHA108db30204b817a2ddc081231f262d7d2c15036d4
SHA256699f2f9d6a54ce01c0a53c6c04c50610703242213ff7f98f7adde1cee569c258
SHA512f413f931f5d120143aefad9a3a621a598b6e6d5d355d81209341c0a66c3bb1b00ddc435ceec8440abd1c881b6e7c2db083c6caa4749ab68b6360e3d7036fde0c
-
Filesize
686KB
MD5029f2de388168c896cc97f4b6e6830f7
SHA108db30204b817a2ddc081231f262d7d2c15036d4
SHA256699f2f9d6a54ce01c0a53c6c04c50610703242213ff7f98f7adde1cee569c258
SHA512f413f931f5d120143aefad9a3a621a598b6e6d5d355d81209341c0a66c3bb1b00ddc435ceec8440abd1c881b6e7c2db083c6caa4749ab68b6360e3d7036fde0c
-
Filesize
633KB
MD5b440cd1c08524ee437551be0e8101648
SHA1ec3eeb02a657a0a738ab254de6cd07afc00d3db3
SHA25622541309e01858650bc4c5ecd309b475d5fa8570cf79e2717a7a9e6680630ac8
SHA512410d0564344a6ee17d9da61d98218be3b30e1f4f9bf08599580e16363dd89b92402bb2226964012fb8818721488282f5b4187c1d175255009c499d32a296f983
-
Filesize
633KB
MD5b440cd1c08524ee437551be0e8101648
SHA1ec3eeb02a657a0a738ab254de6cd07afc00d3db3
SHA25622541309e01858650bc4c5ecd309b475d5fa8570cf79e2717a7a9e6680630ac8
SHA512410d0564344a6ee17d9da61d98218be3b30e1f4f9bf08599580e16363dd89b92402bb2226964012fb8818721488282f5b4187c1d175255009c499d32a296f983
-
Filesize
664KB
MD58916c63bb2d9f362e09802eae324f67c
SHA14a0f70bad7f06934c6f01793d482e8a6fd710e8c
SHA256b490e1699fc60ecf8e9f746eca35f78f81306caabc02d4f12953fa659bafe5bf
SHA512601002a13573fca8302c97f94cef3077bd44406075bfb151215a36094b731e598691b1918529502ef2e22ca08c4408e3b1c963f26b7db690018545b0d4fe6550
-
Filesize
585KB
MD532ce93d47a739f0220f47e18da3aa27f
SHA1b00fe764d63579bffc2edee380449fc926bb983f
SHA256a78551baab9d7ff545aa24d82853e48a43cd907b32c8232900fe7768a93fa6c4
SHA51276dcf6b611f404a9f06abd92eb86e75e35d8227f9681ea2b923ac33e2eccf2def4bef5d5f820bf73b198a5aaaba17ce5a40047dc31f3994f309802d1bd98a0fa
-
Filesize
714KB
MD5aac63536902390ee5c4562691b6755d1
SHA1da731caf11749ed3c63bcee21ce1be90e0bcd80b
SHA2568c76c99e82c30529967cb4a005e88b3d16ab13f7ae4b74845efeb3f777ca43b4
SHA512a2384551206bb853d67a2da06bef6e475a5f9fa50cb7ea38aeb685a350bc22bf038124ea3ac4b98790751852a552fc746053ef9442effffa26a2294690c91ba1
-
Filesize
30.1MB
MD56a704a0486520462da0d096990ade2c1
SHA1e92751dfc1adbdb24dd14d24565fea56a2d0fb78
SHA2569896bbf035f9619580c8a465d9a614a986d61b7320aa8f9a44bcf9db06f4045e
SHA5120ea2daeca5eced636be871c01588e00d73422f568064f79a5bb5a7091c466eff142a24fef9b91a83b11bb189a399a3eae9616da13272f9b520c4e3bd66db7c42
-
Filesize
804KB
MD56d786a58f2d9493c4c06b735d85d3964
SHA1f661c68fa83a38ee69ba2b99a3711b0658444208
SHA256c4f210a104864436818cb9e2a2c866bbff050cfd0c83b71fe5d1e350b5f9c716
SHA5121ba6e13c084b594395bb338da9147588c31264a39ec8f4117d75a8a5f486ee1954836d69615137aef139b5eae777f3ee244cb063190d98c4abe1db9589fc0e3d
-
Filesize
5.3MB
MD5659ce28c32fe4e77da231edecd97fe11
SHA1f2621b191a6b06f4258962d01ad9b240f77da78e
SHA2568de3c142302e6131bc56d8c8d5375374c25c0f53b5e9f26505e44bd8e0bb62d4
SHA512fda3be03e341eeaf86cbbc171fce56bdbb0210db404b65771892a4faabe17cfabc88cc0a4640df27c1b2a15ba5dfb416f79ca47150b3e1f05b9f630685bd71c6
-
Filesize
2.0MB
MD5171e0a3dea2ec4df231a9eb1758f4554
SHA1ba692d4fbd7fcdaee142f1b0b254691a862addaf
SHA256ca436624c573238fd348c0e09b2d1385920ea646f2c8a2d345cb04059f89c4bb
SHA512d0a03659323b5e1ee4fd91678477d91a0b9dcf06846d62419108734e90cb8881225dcc56f6448d48818c88d54efb8544d184db5be4217dd0ea1a8d5be9d886a6
-
Filesize
2.0MB
MD5d1b0e09fd0478de09f0bf792fffc48a3
SHA10a83f0c8cdfec4beb30bd1f7d01d7851d610b48b
SHA2563e5766bfe84daefe00bf059f90aa0af87260e0103ee5bc9c70d4e069a2506d4a
SHA5129071defcdfd8231536ee379d5445b51fee49cd111c673d25ab37b571d16f9503adef4eeb43e98df007e08a3de95ebc6de774c2be4a1298aa32bf00a92f0b3c00
-
Filesize
1.2MB
MD5a4af1c4c1dc9fbf3b89a5c95d0fbeb4c
SHA1be55472000895529825ad8483f8d70b8267cd481
SHA256807c80c98de67d73be79d68b5dd500d205adce5bc0035060dcf530b00fd71f4a
SHA512185ccb70878795496b7adcc6e6a559af1fb53c435a986876ba682ff226a25354cb7e4bb2c997b879c46067a517ac20b8f550a99e2371c80fb243505f38abdf04
-
Filesize
699KB
MD502cd10c667378f41c5fc3ee964283d40
SHA1727b4c72181ea71b365b3a377f593a99cac9b62f
SHA25614c3c7c9222421b59e245613396ead96b0b0036ada48b8b97c21a2f59a2d0353
SHA5122cececd2e264155ed5d51ca784dd8bb436fb00ccec6cedb65d4e5ac6cbca3b95e04bcabd2163c1562fbd27f7ea386268e9c2c8fb19b944aa4889826772db79ed
-
Filesize
611KB
MD5d21bc5c3547aad7cba89a448555ad54a
SHA174150979f13140f02712803af9e17e5e97950112
SHA25602e833bf102807c1fdae9a2d50e0ede58a078e0b3f873e85959a05905d2c3e3b
SHA51258be60fe2f4ce826604126becd6c1267b14dde83ef2e68fb9123e183f0b86f0d0dfc3a548a76e22baa85ec52bb86ee9434c1d24b95c7d6bcaad00d177aec6ada
-
Filesize
664KB
MD58916c63bb2d9f362e09802eae324f67c
SHA14a0f70bad7f06934c6f01793d482e8a6fd710e8c
SHA256b490e1699fc60ecf8e9f746eca35f78f81306caabc02d4f12953fa659bafe5bf
SHA512601002a13573fca8302c97f94cef3077bd44406075bfb151215a36094b731e598691b1918529502ef2e22ca08c4408e3b1c963f26b7db690018545b0d4fe6550
-
Filesize
652KB
MD5f02f77367b681b9c12089fa8a3351f5e
SHA1912f573611ecc6be56e95946acc04fbca854944b
SHA25684fc86cc1ab0a3a3e4daf17c1c1f2444ca352040d69961300b4fc3d72f926b15
SHA512e336da365a0b04773cd0fca6c449fe5294d1470ca0b34cd58b81d70de7fb5ac229ab0aefec137975d70deed6ab7ab90dbae2e23e74fd3e19c513597e9822edab
-
Filesize
585KB
MD532ce93d47a739f0220f47e18da3aa27f
SHA1b00fe764d63579bffc2edee380449fc926bb983f
SHA256a78551baab9d7ff545aa24d82853e48a43cd907b32c8232900fe7768a93fa6c4
SHA51276dcf6b611f404a9f06abd92eb86e75e35d8227f9681ea2b923ac33e2eccf2def4bef5d5f820bf73b198a5aaaba17ce5a40047dc31f3994f309802d1bd98a0fa
-
Filesize
1.2MB
MD50ae9c6c418d97ecf346a02ba2e3356ed
SHA19a2a783e4f2151fd9269bf940d6c37e74f2f2ba0
SHA2567e598b06c1821ded89b84e0322508b8b1d2ef44b248f357f173fc2fe5679d4c0
SHA512eeaa76213b196d3ee17102a539201170e0335a33c4445a0cac32b91534ed2cc6bfb1452467fdbc46d9d5369d2990b48ae87ca4ad2940e3b700ee42410c2658ed
-
Filesize
682KB
MD50b25971c2b26e59745c1d7f5fd25f45f
SHA16d1bb460233e0bc627f51dbb4760f6c1d26fadc1
SHA25682b75b1ec87cc9a24f8e405a1d9de75f6bb6c336971ded33e18892781e597db2
SHA5127ea492925b306677b3e24ebc589d5d6af0f5609b74a7a4dd95f1b5349854d8f08b6953d28610aa92f219f45dc59a349950f7a109cf26c9353c7270200afef667
-
Filesize
713KB
MD52e8e019fe02882515c950a105c57391b
SHA148350399605209eff95dfca764f8332c3ced0d34
SHA256a9fd85fabd5a9107864273d52c3c7798efe83e43714b599b70c74cda9b63b3de
SHA51295dc19b08f6002f487f3b59db20efc52f12d0d53fa39b8020eb39638797de5e560fb3974d97bd570e13f92cdf5ea4ab79f29c5a3e073898637f347d2a096cd66
-
Filesize
699KB
MD508fe53a2e9bceec590a0ba65669bc300
SHA1c1d3274eb433a8389e5f7914fe817ae445861652
SHA256f2a2423ff38d9f1be03894f001b9429701df02a58888f4d66a1cfcb4ad8af667
SHA512dbd5c526895aed7a5de0ef2e00106a79e810df2fe953c022b0b7229d4d1b893d109ccfece2ff537c3a9ae5057e4ef437b533dc2fd1ffb6e927e64ff9e20be4f6
-
Filesize
1.1MB
MD52abde4e7fbc23eaf0156159365f7983c
SHA17d1e7591e67779b6932ae64518f80a27165cf578
SHA256859527aa169cb251ce9d544d82afbb921ada9ce8c55c1e34300679c63be79e2c
SHA5125191d64dc60b15b859659e59ff5e6e168b5fae7356a4ea9b58ac64200801ee0b481d53c35d797b6fb79c13496ce6588009bb400c2dd59cbfdd1894eef4afd034
-
Filesize
589KB
MD5b9b5123f76b5d6f126e487b0db4778bf
SHA13002d8b127f79229382ab6eee7c7b2722f6a09c7
SHA256965ce476b4adaaed789694e89ea9a697c3168060747f7f369b133ffc345b6eac
SHA5123fa838f17176dc0ecd018e7d9e81aa8f232489cb27c0a0b71759fe493d8726b7afe113fad0915b85346d2c4814f64b01c8c00432bd139c4372ac910b41e7971b
-
Filesize
615KB
MD59d2e1b9b010341de6069cc5b7d0db131
SHA1ff4d63dbcee7e379c53e567c9b88c632b5c01708
SHA256830c8fb11017c763621f0028c13ff11d1661cc6e1f3a22e9a96c8ed54eefc8aa
SHA5120b4b4b935819fe8e906510089fea467d1ac875f6db0a7ab2d8d5bf0b64214404e25925e4b75af2476bf76e7f3c75bc53c1e4ed8195a7cc217d0145b230983986
-
Filesize
1.1MB
MD5ec5d8fced03a230f59d76220eb804416
SHA199b4278c199948a02b8eb488645a588c6cbd9e85
SHA256d95db9e610efd2eb6a95aca628cae38ddb24cf82aa36acccafebe8c14019243e
SHA51276f2694f2827f750daf06b098cdec6d38f646d2147f144ce5ca6b0990d1c950a5ac4a5424891ed37d0b1659215ff6d5774725152c6f1cb044725d75930271f1f
-
Filesize
2.1MB
MD516e6fc254d6c726632ba408945fb287e
SHA103b74eb1fb91ec4395349503268b89e847f105d9
SHA25682c8ff9dcbcb17df20ee7cc813bfc0e1d66a543e422d55d13978b1f3d71f6745
SHA512c67fd816747c97f12199747ac42955d3aacf012ffd45564d390498d31a693739da4847f83490cf9cf000394f6390335a23637fbbc09b5baa3bcc5c4548f799ca
-
Filesize
773KB
MD537b045b37c037b3948d8c4f2cb144480
SHA1afba6b3263a50b75845a8bc275d695f5654da2a1
SHA2563bd4385768590fbf93fb1c3e9a51111706de77cb1d6d02284f602386bd2f530c
SHA5129898cdc01dfb42b5069fb35fc7d3435fbe998ff5bbffd117fa370d260af7770b6412194121c47f080f55d25a88c5d8729c72ae14fbbd5fc0c62c0a6b65401108
-
Filesize
2.0MB
MD5e6f2c5d66742c4364729bead371bcff6
SHA113cbbebe7cb7c1286008dff96cef8c0a25ced23f
SHA2560f7f00433d5f5f04c1bd8864409dde2c567d4d54cb12eb7743f1b9b222cc583e
SHA5121bb638bc735dfd1556187fa549db24dec4f9e8f6813f057fd36a8614b7748b12269ec82ba92f6f4c4d027414457b36caf24d06ad20388d0f8cd4dbc057af943d
-
Filesize
2.0MB
MD5171e0a3dea2ec4df231a9eb1758f4554
SHA1ba692d4fbd7fcdaee142f1b0b254691a862addaf
SHA256ca436624c573238fd348c0e09b2d1385920ea646f2c8a2d345cb04059f89c4bb
SHA512d0a03659323b5e1ee4fd91678477d91a0b9dcf06846d62419108734e90cb8881225dcc56f6448d48818c88d54efb8544d184db5be4217dd0ea1a8d5be9d886a6
-
Filesize
656KB
MD5c4126d00a24a94811b04d91780683ee4
SHA1304d6bd8c5f21a12e71d92d661cd8ed6ee91f82f
SHA2562ec95e8901480ef0bf0d946f6add1d249209b6386113bf0166a6d59315d1a151
SHA5127bc73dfda4afccd857d914b0ad1191fb84da8004359b8817aac8758c5866a4ae5315ed5fdd43a4069f8a617ab834b33380fd72d85c9fe80d94444b715487ff8a
-
Filesize
656KB
MD5c4126d00a24a94811b04d91780683ee4
SHA1304d6bd8c5f21a12e71d92d661cd8ed6ee91f82f
SHA2562ec95e8901480ef0bf0d946f6add1d249209b6386113bf0166a6d59315d1a151
SHA5127bc73dfda4afccd857d914b0ad1191fb84da8004359b8817aac8758c5866a4ae5315ed5fdd43a4069f8a617ab834b33380fd72d85c9fe80d94444b715487ff8a
-
Filesize
686KB
MD5029f2de388168c896cc97f4b6e6830f7
SHA108db30204b817a2ddc081231f262d7d2c15036d4
SHA256699f2f9d6a54ce01c0a53c6c04c50610703242213ff7f98f7adde1cee569c258
SHA512f413f931f5d120143aefad9a3a621a598b6e6d5d355d81209341c0a66c3bb1b00ddc435ceec8440abd1c881b6e7c2db083c6caa4749ab68b6360e3d7036fde0c
-
Filesize
585KB
MD532ce93d47a739f0220f47e18da3aa27f
SHA1b00fe764d63579bffc2edee380449fc926bb983f
SHA256a78551baab9d7ff545aa24d82853e48a43cd907b32c8232900fe7768a93fa6c4
SHA51276dcf6b611f404a9f06abd92eb86e75e35d8227f9681ea2b923ac33e2eccf2def4bef5d5f820bf73b198a5aaaba17ce5a40047dc31f3994f309802d1bd98a0fa
-
Filesize
585KB
MD532ce93d47a739f0220f47e18da3aa27f
SHA1b00fe764d63579bffc2edee380449fc926bb983f
SHA256a78551baab9d7ff545aa24d82853e48a43cd907b32c8232900fe7768a93fa6c4
SHA51276dcf6b611f404a9f06abd92eb86e75e35d8227f9681ea2b923ac33e2eccf2def4bef5d5f820bf73b198a5aaaba17ce5a40047dc31f3994f309802d1bd98a0fa