Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
Resource
win10v2004-20220812-en
General
-
Target
3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
-
Size
840KB
-
MD5
40244b155cf2aac338de3ce94f01747d
-
SHA1
b82cc85facaaffe12313fb7f28ee6b37d37f6d97
-
SHA256
3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d
-
SHA512
301a5597e8b9c7660341c17b008911501fd6028de3c955b3a4cecd407b8bc09946b13cb804fd2a3939fd8df2dc0237784cca10ef111edf336208223ecbdf2353
-
SSDEEP
12288:7CpyvXFPTfnCvX66h/NYJ9nDW6FApNg3gZqdDUtOuBiMc/j6KRVrxn7Nl4+GtlrL:+k9P7nCvX6MNYLIbgYJ3chra+GbrL
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d3WQGzd9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sdwef.exe -
Executes dropped EXE 10 IoCs
pid Process 1696 d3WQGzd9.exe 108 awhost.exe 484 sdwef.exe 1352 bwhost.exe 884 bwhost.exe 296 cwhost.exe 336 csrss.exe 1380 cwhost.exe 760 cwhost.exe 696 dwhost.exe -
resource yara_rule behavioral1/memory/296-148-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral1/memory/1380-155-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral1/memory/296-157-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral1/memory/760-162-0x0000000000400000-0x0000000000449000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 976 cmd.exe -
Loads dropped DLL 14 IoCs
pid Process 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 1696 d3WQGzd9.exe 1696 d3WQGzd9.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 296 cwhost.exe 1640 DllHost.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /h" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /j" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /q" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /D" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /j" d3WQGzd9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /H" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /e" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /z" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /X" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /a" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /k" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /m" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /i" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /p" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /Z" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /y" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /R" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /T" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /W" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /Q" sdwef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Program Files (x86)\\Internet Explorer\\lvvm.exe" cwhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /b" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /g" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /d" sdwef.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d3WQGzd9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /P" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /t" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /J" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /s" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /f" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /S" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /E" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /C" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /F" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /w" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /c" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /N" sdwef.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /A" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /Y" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /V" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /G" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /l" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /r" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /M" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /K" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /n" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /v" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /O" sdwef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdwef = "C:\\Users\\Admin\\sdwef.exe /o" sdwef.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1224 set thread context of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 108 set thread context of 268 108 awhost.exe 31 PID 1352 set thread context of 884 1352 bwhost.exe 38 PID 884 set thread context of 1828 884 bwhost.exe 39 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\lvvm.exe cwhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1060 tasklist.exe 1608 tasklist.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \registry\machine\Software\Classes\Interface\{a8b10a90-7cc9-cb3a-842b-f0e02d692f2a} explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a8b10a90-7cc9-cb3a-842b-f0e02d692f2a}\u = "860049491" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a8b10a90-7cc9-cb3a-842b-f0e02d692f2a}\cid = "2615159248487655494" explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1696 d3WQGzd9.exe 268 svchost.exe 1696 d3WQGzd9.exe 268 svchost.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 484 sdwef.exe 484 sdwef.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 484 sdwef.exe 484 sdwef.exe 484 sdwef.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 484 sdwef.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 484 sdwef.exe 484 sdwef.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 484 sdwef.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 484 sdwef.exe 484 sdwef.exe 268 svchost.exe 268 svchost.exe 268 svchost.exe 484 sdwef.exe 268 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1060 tasklist.exe Token: SeDebugPrivilege 1828 explorer.exe Token: SeDebugPrivilege 1608 tasklist.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 1696 d3WQGzd9.exe 108 awhost.exe 484 sdwef.exe 1352 bwhost.exe 696 dwhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 1224 wrote to memory of 992 1224 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 28 PID 992 wrote to memory of 1696 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 29 PID 992 wrote to memory of 1696 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 29 PID 992 wrote to memory of 1696 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 29 PID 992 wrote to memory of 1696 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 29 PID 992 wrote to memory of 108 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 30 PID 992 wrote to memory of 108 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 30 PID 992 wrote to memory of 108 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 30 PID 992 wrote to memory of 108 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 30 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 108 wrote to memory of 268 108 awhost.exe 31 PID 1696 wrote to memory of 484 1696 d3WQGzd9.exe 32 PID 1696 wrote to memory of 484 1696 d3WQGzd9.exe 32 PID 1696 wrote to memory of 484 1696 d3WQGzd9.exe 32 PID 1696 wrote to memory of 484 1696 d3WQGzd9.exe 32 PID 1696 wrote to memory of 828 1696 d3WQGzd9.exe 33 PID 1696 wrote to memory of 828 1696 d3WQGzd9.exe 33 PID 1696 wrote to memory of 828 1696 d3WQGzd9.exe 33 PID 1696 wrote to memory of 828 1696 d3WQGzd9.exe 33 PID 828 wrote to memory of 1060 828 cmd.exe 35 PID 828 wrote to memory of 1060 828 cmd.exe 35 PID 828 wrote to memory of 1060 828 cmd.exe 35 PID 828 wrote to memory of 1060 828 cmd.exe 35 PID 992 wrote to memory of 1352 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 37 PID 992 wrote to memory of 1352 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 37 PID 992 wrote to memory of 1352 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 37 PID 992 wrote to memory of 1352 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 37 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 1352 wrote to memory of 884 1352 bwhost.exe 38 PID 884 wrote to memory of 1828 884 bwhost.exe 39 PID 884 wrote to memory of 1828 884 bwhost.exe 39 PID 884 wrote to memory of 1828 884 bwhost.exe 39 PID 884 wrote to memory of 1828 884 bwhost.exe 39 PID 884 wrote to memory of 1828 884 bwhost.exe 39 PID 992 wrote to memory of 296 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 40 PID 992 wrote to memory of 296 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 40 PID 992 wrote to memory of 296 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 40 PID 992 wrote to memory of 296 992 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 40 PID 1828 wrote to memory of 336 1828 explorer.exe 6
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:336
-
C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\d3WQGzd9.exeC:\Users\Admin\d3WQGzd9.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\sdwef.exe"C:\Users\Admin\sdwef.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:484
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del d3WQGzd9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
-
-
C:\Users\Admin\awhost.exeC:\Users\Admin\awhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:268
-
-
-
C:\Users\Admin\bwhost.exeC:\Users\Admin\bwhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\bwhost.exe"C:\Users\Admin\bwhost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\explorer.exe0000003C*5⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828
-
-
-
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
PID:296 -
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Roaming\conhost.exe%C:\Users\Admin\AppData\Roaming4⤵
- Executes dropped EXE
PID:1380
-
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Local\Temp\dwm.exe%C:\Users\Admin\AppData\Local\Temp4⤵
- Executes dropped EXE
PID:760
-
-
-
C:\Users\Admin\dwhost.exeC:\Users\Admin\dwhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:696
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe3⤵
- Deletes itself
PID:976 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
- Loads dropped DLL
PID:1640
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:1900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
Filesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
Filesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
Filesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
Filesize
364KB
MD5cd93743173ca2f807348c1bcd563a23d
SHA1a165f5e2e55a1ff2c01e00a0296b8113a95a0f54
SHA256453851ea6f12c1e8b4ad550988c89ff0fc3ecaa12f03f4ea62d0243cd7e343e1
SHA512a8c7d5e62b7c64c9e541a60e56b91cce34c2e7888260c1c84eabc991831ab5f03902e08177e5d47acbb898d1e2f1188dbb0ab7556159b9580239f1134936fa21
-
Filesize
364KB
MD5cd93743173ca2f807348c1bcd563a23d
SHA1a165f5e2e55a1ff2c01e00a0296b8113a95a0f54
SHA256453851ea6f12c1e8b4ad550988c89ff0fc3ecaa12f03f4ea62d0243cd7e343e1
SHA512a8c7d5e62b7c64c9e541a60e56b91cce34c2e7888260c1c84eabc991831ab5f03902e08177e5d47acbb898d1e2f1188dbb0ab7556159b9580239f1134936fa21
-
Filesize
53KB
MD568689b2e7472e2cfb3f39da8a59505d9
SHA15be15784ab1193dc13ac24ec1efcabded5fe2df4
SHA256f304eb2cf6479a4fb36fef81c6df4d0225e251002e8f06f26ee196210bf3d168
SHA512269999061cd54b23b92d385689682e687ae9030bc5d26d79dd5e99f72fa4b4eef41f5a7b555325bd558771db92e2feb8a67fb40c87223be9e23ccb498b3bbc88
-
Filesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
Filesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
Filesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
Filesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
Filesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
Filesize
364KB
MD5cd93743173ca2f807348c1bcd563a23d
SHA1a165f5e2e55a1ff2c01e00a0296b8113a95a0f54
SHA256453851ea6f12c1e8b4ad550988c89ff0fc3ecaa12f03f4ea62d0243cd7e343e1
SHA512a8c7d5e62b7c64c9e541a60e56b91cce34c2e7888260c1c84eabc991831ab5f03902e08177e5d47acbb898d1e2f1188dbb0ab7556159b9580239f1134936fa21
-
Filesize
364KB
MD5cd93743173ca2f807348c1bcd563a23d
SHA1a165f5e2e55a1ff2c01e00a0296b8113a95a0f54
SHA256453851ea6f12c1e8b4ad550988c89ff0fc3ecaa12f03f4ea62d0243cd7e343e1
SHA512a8c7d5e62b7c64c9e541a60e56b91cce34c2e7888260c1c84eabc991831ab5f03902e08177e5d47acbb898d1e2f1188dbb0ab7556159b9580239f1134936fa21
-
Filesize
53KB
MD568689b2e7472e2cfb3f39da8a59505d9
SHA15be15784ab1193dc13ac24ec1efcabded5fe2df4
SHA256f304eb2cf6479a4fb36fef81c6df4d0225e251002e8f06f26ee196210bf3d168
SHA512269999061cd54b23b92d385689682e687ae9030bc5d26d79dd5e99f72fa4b4eef41f5a7b555325bd558771db92e2feb8a67fb40c87223be9e23ccb498b3bbc88
-
Filesize
4KB
MD5ff7d5ec20bf73c02317e7a740fffe018
SHA1365ac8cfe5b939854cc1c341caf051bcc45f9372
SHA2561e230847d7034f5ab3bf010f569315e00673859af0574fc9f915636ed905779a
SHA51230854c0d703fd7c6cbc0769d9be4125baa2577ec529d5e48177a434685b66752fd79c50f0321324e23eeb985738f403347748afefae7d8a3bfad388a5b512a44
-
Filesize
5KB
MD53e7a118b119428247edfc5d5ef3761bc
SHA1140e4cb00107678160411f016c4c17611580a209
SHA25697c19f4103a16798202e50a501375d0bf3d7ec1bb654dda230337e85b01b1ec5
SHA512b0e27a4d7aa62f937f275b9f413f75857846ae670bf3aed6e55c1db865485fda89e33dcdffa02ae2ab25f48d5f63f869232f9e6d69f9cdc8a5c93f39de09a925