Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12/10/2022, 17:21
Behavioral task
behavioral1
Sample
5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe
Resource
win10v2004-20220812-en
General
-
Target
5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe
-
Size
234KB
-
MD5
7c417476aa335db03433180a3276e5ae
-
SHA1
40068932a90e2128299dcf23d82ae20cdaf69689
-
SHA256
5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51
-
SHA512
cb26b9212b00860567eb78da735ee7932ab524b732489d788dd3366de769c7c3f2db3757d9b4edc88172265c02a1651dcdc5430519d20f2eda9c48b708e48b3e
-
SSDEEP
6144:2xV8dI3bxRETtXaz/OJepymej5viyT5O/q9DUGEyoSW:2n8dI3b7ETtKKepymejF5aeDUGNoSW
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1224 SkipeTurns.exe 392 SkipeTurns.exe 568 SkipeTurns.exe 1760 SkipeTurns.exe -
resource yara_rule behavioral1/memory/1292-57-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1292-59-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1292-60-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1292-64-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1292-68-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/808-69-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral1/memory/1076-70-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1076-67-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1076-65-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/808-76-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral1/memory/1076-77-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1076-78-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1076-83-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00140000000054ab-85.dat upx behavioral1/files/0x00140000000054ab-86.dat upx behavioral1/files/0x00140000000054ab-89.dat upx behavioral1/files/0x00140000000054ab-88.dat upx behavioral1/files/0x00140000000054ab-87.dat upx behavioral1/files/0x00140000000054ab-91.dat upx behavioral1/files/0x00140000000054ab-94.dat upx behavioral1/files/0x00140000000054ab-101.dat upx behavioral1/files/0x00140000000054ab-111.dat upx behavioral1/memory/1760-117-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/files/0x00140000000054ab-120.dat upx behavioral1/memory/1760-116-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1760-113-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1760-125-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1760-128-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/568-137-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/392-136-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1076-139-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1760-138-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1224-133-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral1/memory/1292-154-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1760-155-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/392-156-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/568-157-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Loads dropped DLL 5 IoCs
pid Process 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 808 set thread context of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 set thread context of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 1224 set thread context of 392 1224 SkipeTurns.exe 32 PID 1224 set thread context of 568 1224 SkipeTurns.exe 33 PID 1224 set thread context of 1760 1224 SkipeTurns.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1012 ipconfig.exe 1044 ipconfig.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1464 reg.exe 1552 reg.exe 1936 reg.exe 1480 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1760 SkipeTurns.exe Token: SeCreateTokenPrivilege 1760 SkipeTurns.exe Token: SeAssignPrimaryTokenPrivilege 1760 SkipeTurns.exe Token: SeLockMemoryPrivilege 1760 SkipeTurns.exe Token: SeIncreaseQuotaPrivilege 1760 SkipeTurns.exe Token: SeMachineAccountPrivilege 1760 SkipeTurns.exe Token: SeTcbPrivilege 1760 SkipeTurns.exe Token: SeSecurityPrivilege 1760 SkipeTurns.exe Token: SeTakeOwnershipPrivilege 1760 SkipeTurns.exe Token: SeLoadDriverPrivilege 1760 SkipeTurns.exe Token: SeSystemProfilePrivilege 1760 SkipeTurns.exe Token: SeSystemtimePrivilege 1760 SkipeTurns.exe Token: SeProfSingleProcessPrivilege 1760 SkipeTurns.exe Token: SeIncBasePriorityPrivilege 1760 SkipeTurns.exe Token: SeCreatePagefilePrivilege 1760 SkipeTurns.exe Token: SeCreatePermanentPrivilege 1760 SkipeTurns.exe Token: SeBackupPrivilege 1760 SkipeTurns.exe Token: SeRestorePrivilege 1760 SkipeTurns.exe Token: SeShutdownPrivilege 1760 SkipeTurns.exe Token: SeDebugPrivilege 1760 SkipeTurns.exe Token: SeAuditPrivilege 1760 SkipeTurns.exe Token: SeSystemEnvironmentPrivilege 1760 SkipeTurns.exe Token: SeChangeNotifyPrivilege 1760 SkipeTurns.exe Token: SeRemoteShutdownPrivilege 1760 SkipeTurns.exe Token: SeUndockPrivilege 1760 SkipeTurns.exe Token: SeSyncAgentPrivilege 1760 SkipeTurns.exe Token: SeEnableDelegationPrivilege 1760 SkipeTurns.exe Token: SeManageVolumePrivilege 1760 SkipeTurns.exe Token: SeImpersonatePrivilege 1760 SkipeTurns.exe Token: SeCreateGlobalPrivilege 1760 SkipeTurns.exe Token: 31 1760 SkipeTurns.exe Token: 32 1760 SkipeTurns.exe Token: 33 1760 SkipeTurns.exe Token: 34 1760 SkipeTurns.exe Token: 35 1760 SkipeTurns.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 1224 SkipeTurns.exe 392 SkipeTurns.exe 568 SkipeTurns.exe 1760 SkipeTurns.exe 1760 SkipeTurns.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 808 wrote to memory of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 wrote to memory of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 wrote to memory of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 wrote to memory of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 wrote to memory of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 wrote to memory of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 wrote to memory of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 wrote to memory of 1292 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 27 PID 808 wrote to memory of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 808 wrote to memory of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 808 wrote to memory of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 808 wrote to memory of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 808 wrote to memory of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 808 wrote to memory of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 808 wrote to memory of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 808 wrote to memory of 1076 808 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 28 PID 1292 wrote to memory of 1012 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 29 PID 1292 wrote to memory of 1012 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 29 PID 1292 wrote to memory of 1012 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 29 PID 1292 wrote to memory of 1012 1292 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 29 PID 1076 wrote to memory of 1224 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 31 PID 1076 wrote to memory of 1224 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 31 PID 1076 wrote to memory of 1224 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 31 PID 1076 wrote to memory of 1224 1076 5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe 31 PID 1224 wrote to memory of 392 1224 SkipeTurns.exe 32 PID 1224 wrote to memory of 392 1224 SkipeTurns.exe 32 PID 1224 wrote to memory of 392 1224 SkipeTurns.exe 32 PID 1224 wrote to memory of 392 1224 SkipeTurns.exe 32 PID 1224 wrote to memory of 392 1224 SkipeTurns.exe 32 PID 1224 wrote to memory of 392 1224 SkipeTurns.exe 32 PID 1224 wrote to memory of 392 1224 SkipeTurns.exe 32 PID 1224 wrote to memory of 392 1224 SkipeTurns.exe 32 PID 1224 wrote to memory of 568 1224 SkipeTurns.exe 33 PID 1224 wrote to memory of 568 1224 SkipeTurns.exe 33 PID 1224 wrote to memory of 568 1224 SkipeTurns.exe 33 PID 1224 wrote to memory of 568 1224 SkipeTurns.exe 33 PID 1224 wrote to memory of 568 1224 SkipeTurns.exe 33 PID 1224 wrote to memory of 568 1224 SkipeTurns.exe 33 PID 1224 wrote to memory of 568 1224 SkipeTurns.exe 33 PID 1224 wrote to memory of 568 1224 SkipeTurns.exe 33 PID 1224 wrote to memory of 1760 1224 SkipeTurns.exe 34 PID 1224 wrote to memory of 1760 1224 SkipeTurns.exe 34 PID 1224 wrote to memory of 1760 1224 SkipeTurns.exe 34 PID 1224 wrote to memory of 1760 1224 SkipeTurns.exe 34 PID 1224 wrote to memory of 1760 1224 SkipeTurns.exe 34 PID 1224 wrote to memory of 1760 1224 SkipeTurns.exe 34 PID 1224 wrote to memory of 1760 1224 SkipeTurns.exe 34 PID 1224 wrote to memory of 1760 1224 SkipeTurns.exe 34 PID 392 wrote to memory of 1044 392 SkipeTurns.exe 35 PID 392 wrote to memory of 1044 392 SkipeTurns.exe 35 PID 392 wrote to memory of 1044 392 SkipeTurns.exe 35 PID 392 wrote to memory of 1044 392 SkipeTurns.exe 35 PID 1760 wrote to memory of 1000 1760 SkipeTurns.exe 37 PID 1760 wrote to memory of 1000 1760 SkipeTurns.exe 37 PID 1760 wrote to memory of 1000 1760 SkipeTurns.exe 37 PID 1760 wrote to memory of 1000 1760 SkipeTurns.exe 37 PID 1760 wrote to memory of 1112 1760 SkipeTurns.exe 39 PID 1760 wrote to memory of 1112 1760 SkipeTurns.exe 39 PID 1760 wrote to memory of 1112 1760 SkipeTurns.exe 39 PID 1760 wrote to memory of 1112 1760 SkipeTurns.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
PID:1012
-
-
-
C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew5⤵
- Gathers network information
PID:1044
-
-
-
C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:568 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XYBLR.bat" "5⤵PID:1128
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkipeTurns" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /f6⤵PID:1088
-
-
-
-
C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:1000
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:1936
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe:*:Enabled:Windows Messanger" /f5⤵PID:1112
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:1512
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:1480
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DarkEye2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DarkEye2.exe:*:Enabled:Windows Messanger" /f5⤵PID:556
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DarkEye2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DarkEye2.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:1552
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142B
MD57aab82a958be0bdc325ec075c874ca64
SHA1f4ab3d6776f6ffc569a878a003df9a4f0a331eb6
SHA256446e766a1c4c57cf38c3b70b1152a5c1216cc86388fefe5d7d39522458436144
SHA5121737e41a539341737e4fc5c22f13c10b34e5054b2e1b44e604490c4faaf943442c596581fb28b0c967935cfd92c5fd4e7331fb72ae2d4f6ef1b8acc64b46f240
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14
-
Filesize
234KB
MD59482d1301879ae497a45c22ea38008d2
SHA1c9a2a143a40007bb4d800cf70247b3eba993fffe
SHA2569537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30
SHA512990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14