Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
Resource
win10v2004-20220812-en
General
-
Target
70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
-
Size
412KB
-
MD5
29b91a8c1b5f6ee2ee190040f9c16977
-
SHA1
9c74f2f45743e81ffb9d621e801cde2ec9ebb495
-
SHA256
70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d
-
SHA512
cd9c0c013339cd1098bc16f65c52a5c12652caaf2b31c9f989cc15c28c3461f8d434930d1e24044fffbe1c14637004317329d1dc1e1cfb0ee3a3de3bbbb6cc08
-
SSDEEP
12288:6Ev1PnyMvotKR3yDoPMVGHTsqItqaXljnnIbnI6stkArNEXS2cNgbusSMU:6EhI62NWXncNgbusSMU
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" HQqGkIT8.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baimaus.exe -
Executes dropped EXE 7 IoCs
pid Process 696 HQqGkIT8.exe 1716 baimaus.exe 1108 2tej.exe 1912 2tej.exe 1724 3tej.exe 336 csrss.exe 1700 4tej.exe -
resource yara_rule behavioral1/memory/1912-83-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1912-85-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1912-86-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1912-90-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1912-91-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1912-93-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1460 cmd.exe -
Loads dropped DLL 10 IoCs
pid Process 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 696 HQqGkIT8.exe 696 HQqGkIT8.exe 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /h" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /H" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /b" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /W" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /R" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /a" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /c" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /U" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /O" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /q" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /o" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /E" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /d" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /B" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /r" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /Y" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /m" HQqGkIT8.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /j" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /P" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /A" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /G" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /V" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /v" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /X" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /L" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /u" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /Z" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /F" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /k" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /z" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /M" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /T" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /K" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /g" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /y" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /s" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /m" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /C" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /f" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /x" baimaus.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ HQqGkIT8.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /w" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /i" baimaus.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /n" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /D" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /p" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /e" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /t" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /S" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /Q" baimaus.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /l" baimaus.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1108 set thread context of 1912 1108 2tej.exe 33 PID 1724 set thread context of 1036 1724 3tej.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1592 tasklist.exe 1808 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 696 HQqGkIT8.exe 696 HQqGkIT8.exe 1912 2tej.exe 1716 baimaus.exe 1724 3tej.exe 1724 3tej.exe 1724 3tej.exe 1716 baimaus.exe 1724 3tej.exe 1912 2tej.exe 1716 baimaus.exe 1716 baimaus.exe 1716 baimaus.exe 1912 2tej.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1716 baimaus.exe 1716 baimaus.exe 1716 baimaus.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1912 2tej.exe 1716 baimaus.exe 1716 baimaus.exe 1716 baimaus.exe 1912 2tej.exe 1912 2tej.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1716 baimaus.exe 1716 baimaus.exe 1912 2tej.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1912 2tej.exe 1716 baimaus.exe 1716 baimaus.exe 1912 2tej.exe 1912 2tej.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1716 baimaus.exe 1716 baimaus.exe 1912 2tej.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe 1716 baimaus.exe 1716 baimaus.exe 1912 2tej.exe 1716 baimaus.exe 1912 2tej.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1808 tasklist.exe Token: SeDebugPrivilege 1724 3tej.exe Token: SeDebugPrivilege 1724 3tej.exe Token: SeDebugPrivilege 1592 tasklist.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 696 HQqGkIT8.exe 1716 baimaus.exe 1108 2tej.exe 1700 4tej.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1672 wrote to memory of 696 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 27 PID 1672 wrote to memory of 696 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 27 PID 1672 wrote to memory of 696 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 27 PID 1672 wrote to memory of 696 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 27 PID 696 wrote to memory of 1716 696 HQqGkIT8.exe 28 PID 696 wrote to memory of 1716 696 HQqGkIT8.exe 28 PID 696 wrote to memory of 1716 696 HQqGkIT8.exe 28 PID 696 wrote to memory of 1716 696 HQqGkIT8.exe 28 PID 696 wrote to memory of 1096 696 HQqGkIT8.exe 29 PID 696 wrote to memory of 1096 696 HQqGkIT8.exe 29 PID 696 wrote to memory of 1096 696 HQqGkIT8.exe 29 PID 696 wrote to memory of 1096 696 HQqGkIT8.exe 29 PID 1672 wrote to memory of 1108 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 31 PID 1672 wrote to memory of 1108 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 31 PID 1672 wrote to memory of 1108 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 31 PID 1672 wrote to memory of 1108 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 31 PID 1096 wrote to memory of 1808 1096 cmd.exe 32 PID 1096 wrote to memory of 1808 1096 cmd.exe 32 PID 1096 wrote to memory of 1808 1096 cmd.exe 32 PID 1096 wrote to memory of 1808 1096 cmd.exe 32 PID 1108 wrote to memory of 1912 1108 2tej.exe 33 PID 1108 wrote to memory of 1912 1108 2tej.exe 33 PID 1108 wrote to memory of 1912 1108 2tej.exe 33 PID 1108 wrote to memory of 1912 1108 2tej.exe 33 PID 1108 wrote to memory of 1912 1108 2tej.exe 33 PID 1108 wrote to memory of 1912 1108 2tej.exe 33 PID 1108 wrote to memory of 1912 1108 2tej.exe 33 PID 1108 wrote to memory of 1912 1108 2tej.exe 33 PID 1672 wrote to memory of 1724 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 35 PID 1672 wrote to memory of 1724 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 35 PID 1672 wrote to memory of 1724 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 35 PID 1672 wrote to memory of 1724 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 35 PID 1724 wrote to memory of 1260 1724 3tej.exe 9 PID 1724 wrote to memory of 336 1724 3tej.exe 6 PID 1724 wrote to memory of 1036 1724 3tej.exe 36 PID 1724 wrote to memory of 1036 1724 3tej.exe 36 PID 1724 wrote to memory of 1036 1724 3tej.exe 36 PID 1724 wrote to memory of 1036 1724 3tej.exe 36 PID 1724 wrote to memory of 1036 1724 3tej.exe 36 PID 1672 wrote to memory of 1700 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 38 PID 1672 wrote to memory of 1700 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 38 PID 1672 wrote to memory of 1700 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 38 PID 1672 wrote to memory of 1700 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 38 PID 1672 wrote to memory of 1460 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 39 PID 1672 wrote to memory of 1460 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 39 PID 1672 wrote to memory of 1460 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 39 PID 1672 wrote to memory of 1460 1672 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe 39 PID 1460 wrote to memory of 1592 1460 cmd.exe 41 PID 1460 wrote to memory of 1592 1460 cmd.exe 41 PID 1460 wrote to memory of 1592 1460 cmd.exe 41 PID 1460 wrote to memory of 1592 1460 cmd.exe 41 PID 336 wrote to memory of 868 336 csrss.exe 20
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe"C:\Users\Admin\AppData\Local\Temp\70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\HQqGkIT8.exeC:\Users\Admin\HQqGkIT8.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\baimaus.exe"C:\Users\Admin\baimaus.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1716
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del HQqGkIT8.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
-
-
C:\Users\Admin\2tej.exeC:\Users\Admin\2tej.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\2tej.exe"C:\Users\Admin\2tej.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
-
-
C:\Users\Admin\3tej.exeC:\Users\Admin\3tej.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1036
-
-
-
C:\Users\Admin\4tej.exeC:\Users\Admin\4tej.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1700
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD51b98630662dace204c7a75ac06ab322f
SHA1f2ebc161d140ce66753f49bf505060216996cdd2
SHA25688cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650
SHA512430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0
-
Filesize
64KB
MD51b98630662dace204c7a75ac06ab322f
SHA1f2ebc161d140ce66753f49bf505060216996cdd2
SHA25688cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650
SHA512430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0
-
Filesize
64KB
MD51b98630662dace204c7a75ac06ab322f
SHA1f2ebc161d140ce66753f49bf505060216996cdd2
SHA25688cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650
SHA512430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0
-
Filesize
204KB
MD5666d8f00ccb49a2a23b174aa89c06ec2
SHA1150f8e4aa5fbfb0df6f33a44885e46d43e789800
SHA256c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a
SHA5120615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f
-
Filesize
204KB
MD5666d8f00ccb49a2a23b174aa89c06ec2
SHA1150f8e4aa5fbfb0df6f33a44885e46d43e789800
SHA256c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a
SHA5120615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f
-
Filesize
44KB
MD5a60c9c8d5563e0004be44141724b18c9
SHA1b48757d94346720a169e1e13f0c58d7607040b84
SHA25698f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d
SHA512bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88
-
Filesize
292KB
MD5f303cad3eb27fbe3210de3ceba0c383a
SHA12d6ee904f441820825872e6a1c25602bbc3f4fc7
SHA25627ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134
SHA512b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d
-
Filesize
292KB
MD5f303cad3eb27fbe3210de3ceba0c383a
SHA12d6ee904f441820825872e6a1c25602bbc3f4fc7
SHA25627ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134
SHA512b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d
-
Filesize
292KB
MD58f1e6f0f3c4dc9c019b057fa053473fc
SHA1a7ce767977f620b92fc3838fa7b92bcc4e1d8d34
SHA2568c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7
SHA512dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e
-
Filesize
292KB
MD58f1e6f0f3c4dc9c019b057fa053473fc
SHA1a7ce767977f620b92fc3838fa7b92bcc4e1d8d34
SHA2568c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7
SHA512dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e
-
Filesize
2KB
MD55bfeb2e8781675fa493027678a658687
SHA1e63c9b5ddd2c8bfe126d90fcab60f836849da629
SHA2568dcad125f6075f304625feffa31c506247e9a08731db509844620f04ec139b31
SHA512b43934c9f4b689c391de5c212792e901c0e137d8192938081cec7add695459c134d60df29474fbcb5285ed1319b62095de89147f7710a3f96dec28393f64d2f5
-
Filesize
64KB
MD51b98630662dace204c7a75ac06ab322f
SHA1f2ebc161d140ce66753f49bf505060216996cdd2
SHA25688cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650
SHA512430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0
-
Filesize
64KB
MD51b98630662dace204c7a75ac06ab322f
SHA1f2ebc161d140ce66753f49bf505060216996cdd2
SHA25688cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650
SHA512430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0
-
Filesize
204KB
MD5666d8f00ccb49a2a23b174aa89c06ec2
SHA1150f8e4aa5fbfb0df6f33a44885e46d43e789800
SHA256c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a
SHA5120615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f
-
Filesize
204KB
MD5666d8f00ccb49a2a23b174aa89c06ec2
SHA1150f8e4aa5fbfb0df6f33a44885e46d43e789800
SHA256c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a
SHA5120615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f
-
Filesize
44KB
MD5a60c9c8d5563e0004be44141724b18c9
SHA1b48757d94346720a169e1e13f0c58d7607040b84
SHA25698f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d
SHA512bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88
-
Filesize
44KB
MD5a60c9c8d5563e0004be44141724b18c9
SHA1b48757d94346720a169e1e13f0c58d7607040b84
SHA25698f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d
SHA512bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88
-
Filesize
292KB
MD5f303cad3eb27fbe3210de3ceba0c383a
SHA12d6ee904f441820825872e6a1c25602bbc3f4fc7
SHA25627ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134
SHA512b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d
-
Filesize
292KB
MD5f303cad3eb27fbe3210de3ceba0c383a
SHA12d6ee904f441820825872e6a1c25602bbc3f4fc7
SHA25627ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134
SHA512b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d
-
Filesize
292KB
MD58f1e6f0f3c4dc9c019b057fa053473fc
SHA1a7ce767977f620b92fc3838fa7b92bcc4e1d8d34
SHA2568c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7
SHA512dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e
-
Filesize
292KB
MD58f1e6f0f3c4dc9c019b057fa053473fc
SHA1a7ce767977f620b92fc3838fa7b92bcc4e1d8d34
SHA2568c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7
SHA512dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e