Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
Resource
win10v2004-20220812-en
General
-
Target
3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
-
Size
840KB
-
MD5
40244b155cf2aac338de3ce94f01747d
-
SHA1
b82cc85facaaffe12313fb7f28ee6b37d37f6d97
-
SHA256
3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d
-
SHA512
301a5597e8b9c7660341c17b008911501fd6028de3c955b3a4cecd407b8bc09946b13cb804fd2a3939fd8df2dc0237784cca10ef111edf336208223ecbdf2353
-
SSDEEP
12288:7CpyvXFPTfnCvX66h/NYJ9nDW6FApNg3gZqdDUtOuBiMc/j6KRVrxn7Nl4+GtlrL:+k9P7nCvX6MNYLIbgYJ3chra+GbrL
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d3WQGzd9.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" naiiso.exe -
Executes dropped EXE 9 IoCs
pid Process 4236 d3WQGzd9.exe 4272 naiiso.exe 3660 awhost.exe 2932 bwhost.exe 3032 bwhost.exe 3472 cwhost.exe 4772 cwhost.exe 1852 cwhost.exe 1640 dwhost.exe -
resource yara_rule behavioral2/memory/3472-179-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4772-183-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3472-185-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/1852-189-0x0000000000400000-0x0000000000449000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation d3WQGzd9.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 56 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /x" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /O" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /j" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /B" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /o" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /h" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /t" naiiso.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d3WQGzd9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /a" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /i" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /R" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /I" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /b" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /Z" naiiso.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /e" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /z" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /E" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /J" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /H" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /m" d3WQGzd9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /p" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /u" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /N" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /v" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /q" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /n" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /P" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /C" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /D" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /c" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /d" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /Q" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /l" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /y" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /K" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /L" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /g" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /m" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /k" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /F" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /s" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /T" naiiso.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Program Files (x86)\\Internet Explorer\\lvvm.exe" cwhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /M" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /f" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /X" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /r" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /w" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /V" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /A" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /S" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /W" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /U" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /G" naiiso.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naiiso = "C:\\Users\\Admin\\naiiso.exe /Y" naiiso.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3532 set thread context of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 3660 set thread context of 4632 3660 awhost.exe 92 PID 2932 set thread context of 3032 2932 bwhost.exe 94 PID 3032 set thread context of 2112 3032 bwhost.exe 95 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\lvvm.exe cwhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2148 2112 WerFault.exe 95 -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2568 tasklist.exe 3808 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4236 d3WQGzd9.exe 4236 d3WQGzd9.exe 4236 d3WQGzd9.exe 4236 d3WQGzd9.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4272 naiiso.exe 4272 naiiso.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2568 tasklist.exe Token: SeDebugPrivilege 3808 tasklist.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 4236 d3WQGzd9.exe 4272 naiiso.exe 3660 awhost.exe 2932 bwhost.exe 1640 dwhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 3532 wrote to memory of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 3532 wrote to memory of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 3532 wrote to memory of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 3532 wrote to memory of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 3532 wrote to memory of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 3532 wrote to memory of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 3532 wrote to memory of 1144 3532 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 83 PID 1144 wrote to memory of 4236 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 86 PID 1144 wrote to memory of 4236 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 86 PID 1144 wrote to memory of 4236 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 86 PID 4236 wrote to memory of 4272 4236 d3WQGzd9.exe 87 PID 4236 wrote to memory of 4272 4236 d3WQGzd9.exe 87 PID 4236 wrote to memory of 4272 4236 d3WQGzd9.exe 87 PID 4236 wrote to memory of 316 4236 d3WQGzd9.exe 88 PID 4236 wrote to memory of 316 4236 d3WQGzd9.exe 88 PID 4236 wrote to memory of 316 4236 d3WQGzd9.exe 88 PID 316 wrote to memory of 2568 316 cmd.exe 90 PID 316 wrote to memory of 2568 316 cmd.exe 90 PID 316 wrote to memory of 2568 316 cmd.exe 90 PID 1144 wrote to memory of 3660 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 91 PID 1144 wrote to memory of 3660 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 91 PID 1144 wrote to memory of 3660 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 91 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 3660 wrote to memory of 4632 3660 awhost.exe 92 PID 1144 wrote to memory of 2932 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 93 PID 1144 wrote to memory of 2932 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 93 PID 1144 wrote to memory of 2932 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 93 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 2932 wrote to memory of 3032 2932 bwhost.exe 94 PID 3032 wrote to memory of 2112 3032 bwhost.exe 95 PID 3032 wrote to memory of 2112 3032 bwhost.exe 95 PID 3032 wrote to memory of 2112 3032 bwhost.exe 95 PID 1144 wrote to memory of 3472 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 98 PID 1144 wrote to memory of 3472 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 98 PID 1144 wrote to memory of 3472 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 98 PID 3472 wrote to memory of 4772 3472 cwhost.exe 99 PID 3472 wrote to memory of 4772 3472 cwhost.exe 99 PID 3472 wrote to memory of 4772 3472 cwhost.exe 99 PID 3472 wrote to memory of 1852 3472 cwhost.exe 100 PID 3472 wrote to memory of 1852 3472 cwhost.exe 100 PID 3472 wrote to memory of 1852 3472 cwhost.exe 100 PID 1144 wrote to memory of 1640 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 101 PID 1144 wrote to memory of 1640 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 101 PID 1144 wrote to memory of 1640 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 101 PID 1144 wrote to memory of 2264 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 108 PID 1144 wrote to memory of 2264 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 108 PID 1144 wrote to memory of 2264 1144 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe 108 PID 2264 wrote to memory of 3808 2264 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\d3WQGzd9.exeC:\Users\Admin\d3WQGzd9.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\naiiso.exe"C:\Users\Admin\naiiso.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4272
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del d3WQGzd9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
-
-
C:\Users\Admin\awhost.exeC:\Users\Admin\awhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
-
-
C:\Users\Admin\bwhost.exeC:\Users\Admin\bwhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\bwhost.exe"C:\Users\Admin\bwhost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\explorer.exe000000D8*5⤵PID:2112
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2112 -s 1126⤵
- Program crash
PID:2148
-
-
-
-
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Roaming\conhost.exe%C:\Users\Admin\AppData\Roaming4⤵
- Executes dropped EXE
PID:4772
-
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Local\Temp\dwm.exe%C:\Users\Admin\AppData\Local\Temp4⤵
- Executes dropped EXE
PID:1852
-
-
-
C:\Users\Admin\dwhost.exeC:\Users\Admin\dwhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 416 -p 2112 -ip 21121⤵PID:3516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
Filesize
68KB
MD5b0406fa1f1b4a471ce4c1521708d1ef3
SHA1bd2bb68d92c8b6af7604d52e336152bc48ea1227
SHA256ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29
SHA51207bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
136KB
MD5acaf206a193335d7983a46a8c9e18fea
SHA13a33b8148c23887c2b9edc2d0dbec3d83398069b
SHA2568aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca
SHA512846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
170KB
MD540d9607cb66da11b9adfec5b93b8b311
SHA155bf463cd5c0c90ba92935ef81ae47ab3bc5fea6
SHA256033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6
SHA512e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078
-
Filesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
Filesize
364KB
MD5db406d87e556a0008c18429ecf3cc93a
SHA13a1b7a87080bf1d78fca904bd7515833bbd380e8
SHA2562712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768
SHA512e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354
-
Filesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
Filesize
24KB
MD5aaa893d374547f20f7fdd7c3b6c56b36
SHA1f7aab7bd60af5e948b71abcccbcfb1d62f6580ff
SHA25617c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03
SHA512491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31
-
Filesize
364KB
MD5761c0317ef6020d13af82f7e5788a213
SHA1f9ce95f8a1644aadf658749eea2049fbc54661d6
SHA25620c7bc3c73464a4100aef1e21133b2064e5875b84ff28b3c1cc7741495508001
SHA51219bc60374e0a63a12d4e36a7ba23ce5a9f106feee60bf46831c2e2adb594e57e73cb253c3feb5ad7a6400401c3988ad5f21034d2c5d4f55720bc2a44a7943b67
-
Filesize
364KB
MD5761c0317ef6020d13af82f7e5788a213
SHA1f9ce95f8a1644aadf658749eea2049fbc54661d6
SHA25620c7bc3c73464a4100aef1e21133b2064e5875b84ff28b3c1cc7741495508001
SHA51219bc60374e0a63a12d4e36a7ba23ce5a9f106feee60bf46831c2e2adb594e57e73cb253c3feb5ad7a6400401c3988ad5f21034d2c5d4f55720bc2a44a7943b67