Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe
-
Size
95KB
-
MD5
0b84527ed1f757fef90372dfb2126eb1
-
SHA1
a5cb7a767c23262ebbe13c9a5258ee37d537d817
-
SHA256
34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd
-
SHA512
d0d9b36dcb3226ae61e494304bd549f3057546e506d04ee6cd90657dcd182a7179d7e06458d898f9729b8c1e43f862148396c80bc02699f71cc8c355175acb0d
-
SSDEEP
1536:kjdUy9hWM4A+mR5qy7OYvXIxBnA+LbOxTZ0U5CGbOKMdfqj6t83ErF:eH+mRLdvXIxBntLbOxKBGbOKM383Ep
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1324 98AD9.exe 3372 98AD9.exe 4348 4F4F8.exe -
Loads dropped DLL 2 IoCs
pid Process 4348 4F4F8.exe 4348 4F4F8.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 4F4F8.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AVACB22L.htm 4F4F8.exe File opened for modification C:\Windows\SysWOW64\98AD9.exe 34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX 98AD9.exe File opened for modification C:\Windows\SysWOW64\4F4F8.exe 98AD9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 4F4F8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 4F4F8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 4F4F8.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 4F4F8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 4F4F8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 4F4F8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 4F4F8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 4F4F8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History 4F4F8.exe Key created \REGISTRY\USER\.DEFAULT\Software 4F4F8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 4F4F8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 4F4F8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P 4F4F8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 4F4F8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 4F4F8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 4F4F8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 4F4F8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 4F4F8.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 4F4F8.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" 4F4F8.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 4F4F8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" 4F4F8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 4F4F8.exe -
Runs net.exe
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4896 34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe 1324 98AD9.exe 3372 98AD9.exe 4348 4F4F8.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4896 wrote to memory of 1324 4896 34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe 82 PID 4896 wrote to memory of 1324 4896 34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe 82 PID 4896 wrote to memory of 1324 4896 34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe 82 PID 1324 wrote to memory of 1368 1324 98AD9.exe 83 PID 1324 wrote to memory of 1368 1324 98AD9.exe 83 PID 1324 wrote to memory of 1368 1324 98AD9.exe 83 PID 1324 wrote to memory of 3428 1324 98AD9.exe 86 PID 1324 wrote to memory of 3428 1324 98AD9.exe 86 PID 1324 wrote to memory of 3428 1324 98AD9.exe 86 PID 4896 wrote to memory of 4332 4896 34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe 85 PID 4896 wrote to memory of 4332 4896 34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe 85 PID 4896 wrote to memory of 4332 4896 34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe 85 PID 1368 wrote to memory of 2240 1368 cmd.exe 89 PID 1368 wrote to memory of 2240 1368 cmd.exe 89 PID 1368 wrote to memory of 2240 1368 cmd.exe 89 PID 2240 wrote to memory of 3664 2240 net.exe 90 PID 2240 wrote to memory of 3664 2240 net.exe 90 PID 2240 wrote to memory of 3664 2240 net.exe 90 PID 3428 wrote to memory of 2108 3428 cmd.exe 91 PID 3428 wrote to memory of 2108 3428 cmd.exe 91 PID 3428 wrote to memory of 2108 3428 cmd.exe 91 PID 4332 wrote to memory of 3724 4332 cmd.exe 92 PID 4332 wrote to memory of 3724 4332 cmd.exe 92 PID 4332 wrote to memory of 3724 4332 cmd.exe 92 PID 2108 wrote to memory of 3808 2108 net.exe 93 PID 2108 wrote to memory of 3808 2108 net.exe 93 PID 2108 wrote to memory of 3808 2108 net.exe 93 PID 3724 wrote to memory of 3408 3724 net.exe 94 PID 3724 wrote to memory of 3408 3724 net.exe 94 PID 3724 wrote to memory of 3408 3724 net.exe 94 PID 3372 wrote to memory of 4144 3372 98AD9.exe 96 PID 3372 wrote to memory of 4144 3372 98AD9.exe 96 PID 3372 wrote to memory of 4144 3372 98AD9.exe 96 PID 4144 wrote to memory of 176 4144 cmd.exe 98 PID 4144 wrote to memory of 176 4144 cmd.exe 98 PID 4144 wrote to memory of 176 4144 cmd.exe 98 PID 176 wrote to memory of 4240 176 net.exe 99 PID 176 wrote to memory of 4240 176 net.exe 99 PID 176 wrote to memory of 4240 176 net.exe 99 PID 3372 wrote to memory of 4348 3372 98AD9.exe 103 PID 3372 wrote to memory of 4348 3372 98AD9.exe 103 PID 3372 wrote to memory of 4348 3372 98AD9.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe"C:\Users\Admin\AppData\Local\Temp\34b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\98AD9.exeC:\Windows\system32\98AD9.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.execmd /c "net start 98AD9"3⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\net.exenet start 98AD94⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start 98AD95⤵PID:3664
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "net start 98AD9"3⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\net.exenet start 98AD94⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start 98AD95⤵PID:3808
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "net start 98AD9"2⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\net.exenet start 98AD93⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start 98AD94⤵PID:3408
-
-
-
-
C:\Windows\SysWOW64\98AD9.exeC:\Windows\SysWOW64\98AD9.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.execmd /c "net start 98AD9"2⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\net.exenet start 98AD93⤵
- Suspicious use of WriteProcessMemory
PID:176 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start 98AD94⤵PID:4240
-
-
-
-
C:\Windows\SysWOW64\4F4F8.exeC:\Windows\system32\4F4F8.exe eee2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4348
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD52b1b7cf833726f0380ec1a33222c5c1f
SHA14fd1e1241181e1c273435af2f51f2764ced2de3e
SHA256e7b8b4f8157c2842ff11295f057bf37179be342ef24f036750f7e0e44a4dc82c
SHA51228478d1141f9408dba2ef8116b0c63b8cd423f1eb53d91a29fffe7e6d2f3c49e74eab45f6b059eeef38794c748b2d8ad550234ff5fbaabc226cad6db6ad2ba8b
-
Filesize
104KB
MD52b1b7cf833726f0380ec1a33222c5c1f
SHA14fd1e1241181e1c273435af2f51f2764ced2de3e
SHA256e7b8b4f8157c2842ff11295f057bf37179be342ef24f036750f7e0e44a4dc82c
SHA51228478d1141f9408dba2ef8116b0c63b8cd423f1eb53d91a29fffe7e6d2f3c49e74eab45f6b059eeef38794c748b2d8ad550234ff5fbaabc226cad6db6ad2ba8b
-
Filesize
95KB
MD50b84527ed1f757fef90372dfb2126eb1
SHA1a5cb7a767c23262ebbe13c9a5258ee37d537d817
SHA25634b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd
SHA512d0d9b36dcb3226ae61e494304bd549f3057546e506d04ee6cd90657dcd182a7179d7e06458d898f9729b8c1e43f862148396c80bc02699f71cc8c355175acb0d
-
Filesize
95KB
MD50b84527ed1f757fef90372dfb2126eb1
SHA1a5cb7a767c23262ebbe13c9a5258ee37d537d817
SHA25634b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd
SHA512d0d9b36dcb3226ae61e494304bd549f3057546e506d04ee6cd90657dcd182a7179d7e06458d898f9729b8c1e43f862148396c80bc02699f71cc8c355175acb0d
-
Filesize
95KB
MD50b84527ed1f757fef90372dfb2126eb1
SHA1a5cb7a767c23262ebbe13c9a5258ee37d537d817
SHA25634b6e285db1e369b7f098c2fd7db85d3e1766bb9c5d10d58bb2f9948e19e0cfd
SHA512d0d9b36dcb3226ae61e494304bd549f3057546e506d04ee6cd90657dcd182a7179d7e06458d898f9729b8c1e43f862148396c80bc02699f71cc8c355175acb0d
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0